[Bug 192925] New: php-fpm.conf: socket ownership / missing UPDATING notice

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=192925

            Bug ID: 192925
           Summary: php-fpm.conf: socket ownership / missing UPDATING
                    notice
           Product: Ports Tree
           Version: Latest
          Hardware: Any
                OS: Any
            Status: Needs Triage
          Severity: Affects Some People
          Priority: ---
         Component: Individual Port(s)
          Assignee: freebsd-ports-bugs at FreeBSD.org
          Reporter: me at cschwarz.com

Recently, the following bug was found in php / php-fpm:

https://bugs.php.net/bug.php?id=67060 (PHP CVE 2014-0185)

This affects the php-fpm.conf: To avoid privilege escalation, php-fpm now
creates sockets with more restricted permissions. The downside: You have to
specify the webserver to be the owner of the socket for the pool.

listen.owner = <socket unix owner>
listen.group = <socket unix group>

If the sockets cannot be accessed by the webserver due to insufficient
privileges, you have a Bad Gateway.

I would like to see this be part of the /usr/ports/UPDATING notice.

-- 
You are receiving this mail because:
You are the assignee for the bug.