Description:
------------
php fcgi and fpm unfortunately allow subprocesses to inherit server socket.

For example, test script:

<?php
system("sleep 1000");
?>

run it using browser over fcgi or fpm, we get:

# pstree -lpu |grep 32686
        |                          `-php55.fcgi(32671)-+-php55.fcgi(32678)---sh(32686)

but now look what descriptors are avilable to "sh" process:
# lsof |grep 32686
[...]
sh        32686         lighttpd    0u     unix 0xffff880261a17700       0t0    9572697 /var/run/php/php-fcgi-32664.sock-1
[...]
sh        32686         lighttpd    3u     unix 0xffff880261a15e80       0t0    9576285 /var/run/php/php-fcgi-32664.sock-1

as you can see "sleep" has access to fcgi socket! And instead of sleep I could run some malicious code.

The same happens with tcp socket in case of fpm over tcp. Processes forked from php have access to server socket 9000.


The solution is to set FD_CLOEXEC (see man fcntl) flag on socket or use proper api (SOCK_CLOEXEC flag, accept4()).


Note that leaking descriptors/sockets falls into secutity catgory in some cases.