Description:
------------
Setting up PHP-FPM with Apache has been improved recently. However unless most other HTTP servers Apache supports modifying the environment variables from .htaccess files. Since PHP-FPM supports passing INI settings from environment this combination allows the user to modify any INI settings.
A simple example is:
SetEnv PHP_ADMIN_VALUE "enable_dl=1"

Related to this is another security problem mentioned in the script referenced in https://bugs.php.net/bug.php?id=63965. This script tries to connect to the FPM socket and change the INI settings for new workers.

I don't know of a good solution. Apache admins could disallow directives like SetEnv, SetEnvIf, BrowserMatch, etc.. however they're quite useful for CGI an FCGI support. So the best solution I came up with is adding a new configuration setting which enables/disables reading PHP_ADMIN_VALUE from environment.