Standard install procedure for PHP 5.3 without Suhosin?

Question

Is there a standard way to install PHP 5.3 without Suhosin?

How would doing so affect tracking of routine updates for precise?

If it's going to make life complicated now or in future then I might just leave it there.

Answer 1

Probably not. Suhosin is considered standard for PHP 5.3.

Using 5.3 without a hardening patch isn't recommended at all, and Suhosin is considered the de facto standard due to its binary compatibility.

Additionally, Precise is the last version running 5.3, so any version you upgrade to will have a fairly major future version of PHP. Since it sounds like you're on LTS releases, this may not be an issue for another year, but it will inevitably come into play.

If you still want to have 5.3 without Suhosin, you're very likely going to need to compile it yourself. It is possible to set it up so that apt/dpkg track dependencies (see this question for more details), but if apt sees you're running an older version of PHP than it has in the repos, it may try to update you, which will include Suhosin.

Alternatively, you could upgrade to 5.4, which has at least upstream standard repos without Suhosin. I think Ubuntu's repos have done the same and released 5.4 without Suhosin. At the very least, the Debian and Arch teams have declared Suhosin "upstream dead," so even if Ubuntu still has it, you should be able to pull straight from Debian, or possibly port the Arch one.