Description:
------------
can you guys please step back from trying to remove everything left and right in PHP 8.0? 

everybody knows that it's not bullet proof but it has it's value

the performance penalty is only because of the hardcoded nonsense instead a ini-option we patch out of PHP because with disable_functions="symlink" the race can't happen

until you fix the design of realpath cache it's worthless anyways
https://bugs.php.net/bug.php?id=73888

-------- Weitergeleitete Nachricht --------
Betreff: [PHP-DEV] open_basedir?
Datum: Tue, 7 May 2019 12:11:03 +0200
Von: Nikita Popov <nikita.ppv@gmail.com>
An: PHP internals <internals@lists.php.net>

Hi internals,

The open_basedir ini setting has two significant problems:

1. It is a major performance hit, because it disables the realpath cache.

2. Many people think it is a security feature and use it as such. However,
open_basedir is in reality a "best effort" mechanism, with known
workarounds and more regularly being found. Especially when it comes to
interactions with 3rd party libraries, enforcing open_basedir is simply
impossible.

What open_basedir tries to do must be implemented on the operating system
level to work reliably (and of course such mechanisms exist, such as jails,
chroot and friends).

I wonder if it is feasible to drop this ini setting? Enforcing this doesn't
really seem like any of PHP's business. If not, I think we need to at least