User isolation in LAMP

Question

As I understand, in a typical LAMP (or be it LEPP) setup, all PHP code is executed using the same user and group ("www" or similar). In a multi-user scenario (e.g. some variant of allowing Linux user accounts to propagate a public_html directory with PHP code), wouldn't this pose a significant risk of users compromising other users' web space or other resources belonging to "www"?

Common advice seems to be to disable "dangerous" PHP functions (i.e. variants of exec) and setting the PHP option open_basedir to limit the files that can be accessed by PHP.

These measures, while comprehensible, don't seem to be reliable:

open_basedir bypasses are not considered to be security issues

https://bugs.php.net/bug.php?id=81131#1626104172

Is it a viable alternative to run separate PHP instances per user (e.g., by creating separate php-fpm pools) to shift the responsibility of privilege separation to the Linux system?

In a production environment, such as a commercial web hosting service,

• What kind of setup can I expect to find?
• And why is it that while the former solution is widely advised, it seems difficult to find guidance online regarding the latter approach?

Answer 1

In a production environment, such as a commercial web hosting service, what kind of setup can I expect to find?

In small operations (i.e. not separated virtual instances), I've usually seen this done with PHP-FPM (FastCGI PHP Module), with different websites running with different FPM pools, different users, and different resource allocations.

While this leaves open the possibility of some exploit at the HTTP level, since the Web code is run all by the same user (which ought to have limited rights, but has rights on all the website communications), actual compartmentalization is quite satisfactory (resource metering might be just a bit unreliable if some process tries, say, to hog the CPU; if that bothers you, then you need go the container or even the virtual machine way).

You can have separate pools that do not communicate (aside from having a common ancestor process) and have no rights on each other's stuff.

If I recall correctly, in the default configuration there is still some care to be taken when using temporary files, to avoid them being mutually accessible (depending on the OS configuration they'll be all in the /tmp or all in the /tmp/systemd-temp-per-process-whatever/tmp directory). You need to check sys_temp_dir and upload_temp_dir to make them per-pool (and you need to create them manually the first time).

A Google search finds lots of documentation and tutorial about how to do all this.