Add security warning about publicly exposed PHP-FPM

Author: lacatoire

install/fpm/configuration.xml

@@ -251,6 +251,15 @@
         'ip.add.re.ss:port', 'port', '/path/to/unix/socket'. This option is
         mandatory for each pool.
        </para>
+       <warning>
+        <simpara>
+         Prefer Unix sockets over TCP sockets when the web server runs on
+         the same host. If a TCP socket must be used, ensure it is not
+         exposed to untrusted networks and restrict access using
+         <link linkend="listen-allowed-clients">listen.allowed_clients</link>.
+         An exposed FastCGI endpoint allows arbitrary code execution.
+        </simpara>
+       </warning>
       </listitem>
      </varlistentry>
      <varlistentry xml:id="listen-backlog">

install/fpm/index.xml

@@ -3,6 +3,21 @@
   <chapter xml:id="install.fpm" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
    <title>FastCGI Process Manager (FPM)</title>
    &fpm.intro;
+   <warning>
+    <para>
+     PHP-FPM must not be publicly exposed to the network. A FastCGI
+     endpoint that is accessible from untrusted sources allows
+     <emphasis>arbitrary code execution</emphasis>. When using TCP
+     sockets, restrict access using the
+     <link linkend="listen-allowed-clients">listen.allowed_clients</link>
+     directive to allow connections from the web server only. Prefer
+     Unix sockets over TCP sockets when the web server runs on the same
+     host, as they can be protected with filesystem permissions. When
+     using Docker or similar container setups, do not expose PHP-FPM
+     ports to the host or external networks; communicate between
+     containers using an internal network instead.
+    </para>
+   </warning>
    <para>
     These features include:
     <itemizedlist>