Wrong value from ini_get() for shared files because of opcache optimization

[bix0r]

Description

Opcache saves values from ini_get() for PHP_INI_SYSTEM type directives in the opcache when optimization is enabled.
This is a problem when a shared file uses ini_get() for PHP_INI_SYSTEM.

Example of this is a server with multiple virtual hosts where the sites use a common/shared framework.
The framework has an image uploading part where it fetches the upload_tmp_dir setting from ini to use a place for temporary image manipulations.
The virtual hosts are set up using PHP_ADMIN_VALUE to set a specific upload folder for each site.

fastcgi_param PHP_ADMIN_VALUE "upload_tmp_dir=/tmp/uploads/site1";

In this scenario the framework uses ini_get('upload_tmp_dir') to get the tmp folder value, but the value it gets is always the value for the first site that included that php file. So if site "foo.example.com" was first, then ALL other sites will get the upload_tmp_dir from "foo.example.com".

I reproduced this in all versions >=7.2, and for cli, fpm and mod_php.

Security

Not sure this counts as a security problem but this means that information could leak between sites.

Note that using PHP_ADMIN_VALUE for any option results in this problem.

Ways to reproduce:

Setup php files

mkdir /tmp/test/ && cd /tmp/test/
echo '<?php echo "S: " . ini_get("upload_tmp_dir") . "\n";' > shared.php
echo '<?php echo "1: " . ini_get("upload_tmp_dir") . "\n"; include "./shared.php";' > 1.php
echo '<?php echo "2: " . ini_get("upload_tmp_dir") . "\n"; include "./shared.php";' > 2.php

Cli

Create a cli-opcache.ini file in the "scan" additional .ini files directory:

zend_extension=opcache.so
[opcache]
opcache.enable=1
opcache.enable_cli=1
opcache.file_cache="/tmp/php-file-cache"
opcache.file_cache_only=1
opcache.file_cache_consistency_checks=1

Create file cache folder

mkdir /tmp/php-file-cache

Run the test

php -d upload_tmp_dir=/tmp/num1 /tmp/test/1.php
php -d upload_tmp_dir=/tmp/num2 /tmp/test/2.php

Expected result:

1: /tmp/num1
S: /tmp/num1
2: /tmp/num2
S: /tmp/num2

Actual result:

1: /tmp/num1
S: /tmp/num1
2: /tmp/num2
S: /tmp/num1

nginx + fpm

Make sure that opcache with optimizations is enabled.

Setup two virtual hosts and reload nginx:

server {
    listen 80; 
    server_name p1; 
    root /tmp/test; 
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
	    fastcgi_pass   127.0.0.1:9000;
	    fastcgi_param  PHP_ADMIN_VALUE "upload_tmp_dir=/tmp/cache1";
    }
}

server {
    listen 80; 
    server_name p2; 
    root /tmp/test; 
    location ~ \.php$ {
	    include snippets/fastcgi-php.conf;
	    fastcgi_pass   127.0.0.1:9000;
	    fastcgi_param  PHP_ADMIN_VALUE "upload_tmp_dir=/tmp/cache2";
    }
}

Run the tests:

curl --resolve p1:80:127.0.0.1 http://p1/1.php
curl --resolve p2:80:127.0.0.1 http://p2/2.php

Expected result:

1: /tmp/cache1
S: /tmp/cache1
2: /tmp/cache2
S: /tmp/cache2

Actual result:

1: /tmp/cache1
S: /tmp/cache1
2: /tmp/cache2
S: /tmp/cache1

Workarounds

For me, I ended up with changing the shared framework, and now have to maintain my own fork of it.

You can turn off opcache optimizations.

Another way to work around this is to compile php yourself, with removing the ini_get if block, or even just
changing ini_get to ini_get_opcache_workaround in the zend_optimizer_eval_special_func_call function
in Zend/Optimizer/zend_optimizer.c.

PHP Version

7.2.0 - 8.1.6

Operating System

No response

[arnaud-lb]

Does it happen only with opcache.file_cache enabled ? I would recommend to use a separate cache dir when PHP_INI_SYSTEM entries differ.

[bix0r]

No, this always happens when opcache optimization is enabled.

[arnaud-lb]

The problem seems to be that we allow PHP_INI_SYSTEM entries to be modified on a per-request basis via fastcgi_param PHP_ADMIN_VALUE.

The purpose of PHP_ADMIN_VALUE is to make an ini setting non modifiable by the script (with e.g. ini_set), but apparently the way it is implemented allows to override PHP_INI_SYSTEM entires.

Since PHP_INI_SYSTEM entries are not supposed to be modified, I think that the opcache makes the right assumption here.

[bix0r]

I guess you are correct that opcache is making the right assumption here based on that information. But, there must be a way to change settings based on the virtual host. Using the php_admin_value seems to be the best way to that.

Using php_admin_value (and friends) is also the recommended way, and it sounds quiet bad that doing things according to the documentation will result in leaking of information.

The performance benefits from using opcache for these kind of settings seem insignificant enough that I can't see a reason for making this issue more complicated.

[arnaud-lb]

I agree with this.

There are some PHP_INI_SYSTEM entries that will really break PHP if they are changed like this, though.

Maybe we should promote some ini settings to PHP_INI_PERDIR (or introduce a new mode), and then prevent PHP_INI_SYSTEM value from being modified via PHP_ADMIN_VALUE.

[bukka]

Maybe we should promote some ini settings to PHP_INI_PERDIR (or introduce a new mode), and then prevent PHP_INI_SYSTEM value from being modified via PHP_ADMIN_VALUE.

That might break things potentially.

I added this to my big list of php_admin_value issues as there are lots of bugs related to overrides and similar problems so this looks like an another one to look at.