Question: This looks weird, I have an apache httpd server in a CentOS box, which has this security problem:

Virtual hosts are enabled, the site is in /data/www/vhost2/index.php
It looks like that if I tell index.php to look for a file in ../../ (so it exits the www directory) it SEES IT! How can I block php from looking outside this directory? Do I have to use basedir? What about virtualhosts, is it possible to do it for every folder in a sandbox-like way?

Thanks

Answer: 
Hackers generally bypass open\_basedir using symlinks. My server was hacked several times using this. The best way is to install Suhosin and disable potentially dangerous functions like symlink. Below is the link of installation tutorial probably old but may work

<http://www.webhostgear.com/416.html>

then block following functions using below directive in php.ini

```
suhosin.executor.func.blacklist = "show_source,shell_exec,passthru,exec,popen,system,system, shell_exec, passthru, exec, popen, proc_open, symlink, php_uname,etmyuid,passthru,leak,listen,diskfreespace,link,ignore_user_abord,shell_exec,dl,exec,highlight_file,source,show_source,fpaththru,virtual,posix_ctermid,posix_getcwd,symlink,popen,system,escapeshellarg,escapeshellcmd,myshellexec,c99_buff_prepare,c99_sess_put,posix_getegid,posix_geteuid,posix_getgid,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid,posix,getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_isatty,posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid,posix_setpgid,posix_setsid,posix_setuid,posix_times,posix_ttyname,posix_uname,proc_open,proc_close,proc_get_status,proc_nice,proc_terminate"

```
If you have many virtualhosts configured you can set php\_admin\_value open\_basedir /path\_to\_the\_virtual\_root, so you can set open\_basedir by virtualhost