Stop Exploits And Malicious Execs: Safe Mode

I decided to apply PHP safe mode to my servers, considering:

- I cannot prohibit using exec functions (some binary uses are needed, like host, mysqldump, etc..)

- I cannot restrict at all via UID/GID method at bins due to several problems..

Safe mode is the final sollution, as I only need "safe_mode_exec_dir" config to set a folder with the necesary binaries... this will stop nobody user (Apache) to exec whatever it wants, like perl, binaries uploaded to an public insecure folder (exploits), or anything else... people only could exec() the binaries I want and where I want. This will stop finally 95% of my hack problems.

Well. The problem is safe_mode is enabled or not, but you cannot set o disable certain features of this safe mode, like UID/GID checks (*******!)...

I am trying to configure so only "safe_mode_exec_dir" would apply, so:

- Including UIDs checks disabled by:
safe_mode_include_dir = "/home/"
(tested)

- Some variables set to NULL, as safe_mode_allowed_env_vars or safe_mode_protected_env_vars...

- safe_mode_exec_dir = "/usr/phpbin/"
Great! with symbolic lynks in... the best sollution available for me.

- open_basedir = "/home/"
(for fopen, etc...)

Ok ok.. but problems there.. by example this one:

Quote:

Warning: fopen() [function.fopen]: SAFE MODE Restriction in effect. The script whose uid is 32015 is not allowed to access cache/dynamic_fields/modules.php owned by uid 99 in /home/yyyyyyyyy/public_html/chn/modules/DynamicFields/DynamicField.php on line 823

Great.. fopen is under UID/GID checks, but it is not an include, so safe_mode_include_dir would not apply...

Now fopen, link, unlink, etc.. functions are UID restricted and this seems to be impossible to disable.... pffffffff...

can you share your safe_mode configs or sollutions for this problem?