open_base_dir and Joomla performance

[fatica]

Hi all,

Posting here to raise the visibility of the tremendous impact of the open_base_dir setting in php on Joomla performance. We saw huge performance gains in CPU utilization when removing the open_base_dir restrictions we had previously set.

This rather epic bug report shows the background of this long-standing issue:
https://bugs.php.net/bug.php?id=52312

Obviously there's a security trade-off here, but we saw a nearly 50% drop in average CPU utilization, TTFB, etc. open_base_dir is important to protect security from file inclusions hacks, especially if you're running a lot of untrusted code (e.g. extensions).

This issue crosses all modern versions of PHP. Just an FYI.

[pe7er]

Interesting! Thanks for this info!

Maybe your performance decrease has to do with Realpath cache. I found some bug reports regarding "Realpath cache" which is apparently disabled when open_basedir is set.
Some technical info https://github.com/Whissi/realpath_turbo

[fatica]

Yes, that is the same issue. open_base_dir or safemode kills the realpath cache, effectively halving Joomla performance. This isn't necessarily Joomla specific, but any CMS or application that leverages a lot of files & includes as in Joomla, Magento, etc.

[Per Yngve Berg]

open_base_dir is not used widely anymore. It's a relic from the past.

Use Linux User Permissions to the folders together with cgi or fpm-cgi web server to php interface. A separate user for each site prevents cross contamination.

[fatica]

Yes, I am also a relic from the past, but it doesn't mean there aren't scores of articles that recommend enabling open_basedir restrictions as a security measure *including Joomla's own security checklist* and I feel folks should know the cost of that setting in Joomla.


https://docs.joomla.org/Special:MyLangu ... en_basedir