Question: This looks weird, I have an apache httpd server in a CentOS box, which has this security problem:

Virtual hosts are enabled, the site is in /data/www/vhost2/index.php
It looks like that if I tell index.php to look for a file in ../../ (so it exits the www directory) it SEES IT! How can I block php from looking outside this directory? Do I have to use basedir? What about virtualhosts, is it possible to do it for every folder in a sandbox-like way?

Thanks

Answer: 
This is normal behavior for unconfigured and unhardened system, you can symply set `open_basedir` option in `php.ini` to define limit (<http://www.php.net/manual/en/ini.core.php#ini.open-basedir>).

But it won't limit shell scripts and `exec` commands run from php script from accessing these files, you may disable some of these functions with `disable_functions`.

Generally, there are many things regarding hardening and it's not that easy to list them in here, and it's architectural. For example, currently, I guess, you are running apache prefork MPM with mod\_php, in case of mod\_fcgid + php-cgi - you won't be able to work with `/data` at all, because it's limited by mod\_fcgid to the `/var/www/`, also, there is selinux limitation by default `targeted` policy etc.

You will find more and more issues like this.
If you have many virtualhosts configured you can set php\_admin\_value open\_basedir /path\_to\_the\_virtual\_root, so you can set open\_basedir by virtualhost