Search code examples
phpsecuritypcntlprocess-control

What are the side-effects of enabling PROCESS CONTROL (PCNTL) in PHP on web server environment?



below is a quotation from http://www.php.net/manual/en/intro.pcntl.php

Process Control should not be enabled within a web server environment and unexpected results 
may happen if any Process Control functions are used within a web server environment.

what are the side-effects of enabling it on my web server? what are the threatens and security concerns in it?

Thanks a lot for your help


Solution

  • There's a big difference between just enabling the extension and using the functions. Just enabling the extension should have no side effects whatsoever.

    On the other hand, the functions made available can allow for some mischief. Forks can be abused, signals can be sent to other processes, telling them to perform actions that you otherwise might not want, and priorities of processes with the same owner as the web server daemon can be modified.

    In other words, it's not something you'd want to enable unless you control all of the PHP running on that machine, like in a shared hosting environment.