On: Facebook PHP Source Code from August 2007

[duskwuff]

`chroot()` has no place in a web application. The system call requires the process to be running as root.

[voltagex_ → duskwuff]

Can you call that and then drop permissions?

[duskwuff → voltagex_]

In theory, yes. But that's still bad, because it means that a nontrivial amount of your application code (as well as whatever is launching it, like the PHP-FPM server or the web server) is running as root.