Suhosin patch should not be installed by default in Ubuntu

Updating our server from Ubuntu 7.10 to 8.04 made numerous scripts fail, some (but not all) of which were related to MS SQL server transactions. I spent some time looking around on it and it turns out that in 8.04 the Suhosin patch is applied to PHP by default. There’s no way to opt out of it. Here’s a great blog post showing how to put it together without  it. Turns out there is php5-suhosin the package, and then there’s php5 the package (with Suhosin patch applied). I found a bug report where the maintainer of the debian package php5-suhosin claims that it does nothing but enable logging. Be that as it may, it makes scripts fail. After following the steps to recompile php5 without suhosin the site is working normally again.

I am copying the steps that the above author posted from info he gleaned from the ubuntu lists, just in case the link goes dead:

  1. Get the php5 source best price cialis (this puts it in a folder work for cleanliness sake): mkdir work && cd work && apt-get source php5 && cd php5-5.2.4
  2. Make sure you can build it by doing: sudo apt-get build-dep php5
  3. Remove suhosin patch: rm debian/patches/suhosin.patch
  4. nano debian/patches/series
  5. Remove suhosin.patch line (it’s near the bottom of the file).
  6. If you never built a debian package before: sudo apt-get install devscripts
  7. Change version number (DO NOT PUT THE WORD suhosin in the version name): debchange -v 5.2.4-2ubuntu6~customName
  8. When you get presented with the nano text editor, just type something like “Hopefully removed Suhosin”, and press Ctrl+X and Enter to save.
  9. Build (this takes a while):  debuild
  10. The .deb packages should be in the folder if done correctly:   ls -l ../*.deb
  11. Quick install:  sudo dpkg -i ../*.deb

Leave a Reply

  

  

  

*

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>