[Security] Native libraries loaded by soname are subject to search-path hijacking

[s2x]

Context / Problem

The native libraries are loaded by bare soname:

src/NativeClient.php:179-181 — FFI::cdef(..., 'libfdb_c.so'), 'libpthread.so.0', 'libdl.so.2'
src/NativeClient.php:220 — dlopen('libfdb_c.so', RTLD_LAZY)

Loading depends on the linker search path (LD_LIBRARY_PATH/RUNPATH/cwd in some configurations). A malicious libfdb_c.so earlier on the path would execute arbitrary code inside the PHP process. This is primarily a deployment risk, but the library can reduce the attack surface.

Affected files / locations

• src/NativeClient.php:177-182,220

Proposed approach

Allow configuring an absolute path to the FoundationDB client library (constructor argument / environment variable) and load from that pinned path when provided; document the recommendation to pin the path in production.

Acceptance Criteria

• Documentation updated/added (security note + configuration)
• Unit test(s) added covering path resolution/selection logic
• Functional test(s) added: loading from an explicit absolute path works
• Changelog entry added
• Post-implementation comment posted on this issue describing what was changed

Severity

Low