Skip to content

Commit ff7a717

Browse files
authored
Update README.md
1 parent a342986 commit ff7a717

File tree

1 file changed

+49
-3
lines changed

1 file changed

+49
-3
lines changed

README.md

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,52 @@
22

33
PHPStatic package is build for better performance, check our [benchmarks](https://github.com/phpstatic/phpstatic.com/blob/master/benchmarks.md).
44

5+
PHPStatic package is build as static shared object, to reduce the dynamic library runtime overheads and attack surface. Static link also allow our package suite for most of linux distribution, avoid dependent library not match during upgrade system.
6+
```sh
7+
$ file /usr/local/bin/php
8+
/usr/local/bin/php: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, stripped
9+
10+
$ readelf -l ./php
11+
12+
Elf file type is DYN (Shared object file)
13+
Entry point 0x37f9a8
14+
There are 7 program headers, starting at offset 64
15+
16+
Program Headers:
17+
Type Offset VirtAddr PhysAddr
18+
FileSiz MemSiz Flags Align
19+
LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000
20+
0x0000000002b48980 0x0000000002b48980 R E 0x200000
21+
LOAD 0x0000000002b49920 0x0000000002d49920 0x0000000002d49920
22+
0x0000000000256b80 0x000000000035ee48 RW 0x200000
23+
DYNAMIC 0x0000000002d45540 0x0000000002f45540 0x0000000002f45540
24+
0x00000000000001d0 0x00000000000001d0 RW 0x8
25+
TLS 0x0000000002b49920 0x0000000002d49920 0x0000000002d49920
26+
0x0000000000000088 0x0000000000005d98 R 0x20
27+
GNU_EH_FRAME 0x000000000278ccbc 0x000000000278ccbc 0x000000000278ccbc
28+
0x0000000000080d5c 0x0000000000080d5c R 0x4
29+
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
30+
0x0000000000000000 0x0000000000000000 RW 0x10
31+
GNU_RELRO 0x0000000002b49920 0x0000000002d49920 0x0000000002d49920
32+
0x00000000001fd6e0 0x00000000001fd6e0 R 0x1
33+
34+
Section to Segment mapping:
35+
Segment Sections...
36+
00 .hash .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_d .rela.dyn .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame .gcc_except_table
37+
01 .tdata .init_array .fini_array .ctors .dtors .data.rel.ro .dynamic .got .data .bss
38+
02 .dynamic
39+
03 .tdata .tbss
40+
04 .eh_frame_hdr
41+
05
42+
06 .tdata .init_array .fini_array .ctors .dtors .data.rel.ro .dynamic .got
43+
44+
$ otool -L /usr/local/bin/php # for macOS package
45+
/usr/local/bin/php:
46+
/usr/lib/libresolv.9.dylib (compatibility version 1.0.0, current version 1.0.0)
47+
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.50.4)
48+
```
49+
50+
551
PHPStatic package also build for security, by add gcc flags `-fstack-clash-protection`, `-fstack-protector-strong`, `-Wp,-D_FORTIFY_SOURCE=2`, `-Wp,-D_GLIBCXX_ASSERTIONS`, `-fPIE`, `-Wl,-z,now`, `-Wl,-z,relro`, `-Wl,-z,text`, `-Wl,-z,noexecstack` to enable `Address space layout randomization`, `Full RELRO`, `STACK CANARY`, `non-executable stack`, `FORTIFY`, `stack clash protection`, `stack overflow protection`.
652

753
PHPStatic is immune to LD_PRELOAD preload attacks like [this](https://github.com/yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD).
@@ -17,8 +63,8 @@ Linux package need CPU support AVX.
1763
run this on your project dirs:
1864

1965
```sh
20-
docker pull phpstatic/php:7.4.5
21-
docker run --name php74 -itd -v $(pwd):/app --mount source=php74_etc,target=/usr/local/etc/php phpstatic/php:7.4.5
66+
docker pull phpstatic/php:7.4.9
67+
docker run --name php74 -itd -v $(pwd):/app --mount source=php74_etc,target=/usr/local/etc/php phpstatic/php:7.4.9
2268
docker logs php74
2369
docker volume inspect php74_etc
2470
docker exec -i -t php74 composer install
@@ -221,7 +267,7 @@ Zend OPcache
221267

222268
# nginx -V
223269

224-
nginx 1.18.0 is build with [http3](https://en.wikipedia.org/wiki/HTTP/3), [njs](https://github.com/nginx/njs.git)(0.4.0), ssl_stapling+BoringSSL support.
270+
nginx 1.18.0 is build with [http3](https://en.wikipedia.org/wiki/HTTP/3), [njs](https://github.com/nginx/njs.git)(0.4.3), [io_uring](https://github.com/hakasenyang/openssl-patch/pull/41), ssl_stapling+BoringSSL support(the only solution that support multi domain without cronjob).
225271

226272
```sh
227273
nginx version: nginx/1.18.0 (nginx)

0 commit comments

Comments
 (0)