PHP-FPM rm Permission denied - shell

I have nginx+php-fpm and I need to delete folder recursively from php-script:
<?php
error_reporting(E_ALL);
ini_set('display_errors', '1');
ini_set('display_startup_errors', '1');
$out = shell_exec('/bin/rm -vrf /data/vmail/test');
var_dump($out);
$out is NULL, but in error.log i receive
WARNING: [pool www] child 7210 said into stderr: "rm: "
WARNING: [pool www] child 7210 said into stderr: "cannot remove `/data/vmail/test'"
WARNING: [pool www] child 7210 said into stderr: ": Permission denied"
PHP-FPM runs under user "nginx"
NGINX runs under user "nginx"
/data/vmail and all child folders are owned by vmail:vmail (chmod 770)
Supplementary groups exists:
# groups nginx
nginx : nginx vmail
# groups vmail
vmail : vmail nginx
Solutions
If I chown /data/vmail/test to nginx:nginx it contents becomes deleteable. But /data/vmail/test still is not, as long as /data/vmail is owned by vmail:vmail I suppose.
If I chmod -R 777 /data/vmail/test && chmod 777 /data/vmail the meant folder becomes deleteable.
PHP-function rmdir() works (don't know why)! But recursive deletion for large folders is too resource-intensive
I don't consider these options as a solution. Also I don't consider a solution involving root user and /etc/sudoers or running php-fpm as a root. So... how is it possible to get /bin/rm working?
Additional info ##
php-fpm.conf
nginx.conf

Deleting content of a directory is a write operation in The directory. So the user that runs PHP needs write permission on /data/vmail.

Related

trying to enable a user to see the letsencrypt keys

I do not know if this is the right place to ask, but I'l give it a try
I was trying to let user mysql read the letsencrypt keys.
Normally any user can see the live and the archive folders so the mysql user can also
debian:~# sudo -u mysql ls /etc/letsencrypt/archive/
example1.com example2.com example3.com
if I try to see the files in there
debian:~# sudo -u mysql ls /etc/letsencrypt/archive/example1.com
ls: Zugriff auf /etc/letsencrypt/archive/example1.com/ nicht möglich: Keine Berechtigung
(what means in german : you have no right to see the files.)
then I garbed setfacl and tried to gain mysql access to the files, so I went:
setfacl -R -m "u:mysql:r" /etc/letsencrypt/archive/
then I checked the acl
debian:~# getfacl /etc/letsencrypt/archive/example1.com
getfacl: Entferne führende '/' von absoluten Pfadnamen
# file: etc/letsencrypt/archive/example1.com
# owner: root
# group: root
user::rwx
user:mysql:r--
group::r-x
mask::r-x
other::r-x
then I became confident and praised myself, as I always do when I do smart things
For some reason I checked again :
debian:~# sudo -u mysql ls /etc/letsencrypt/archive/example1.com
ls: Zugriff auf /etc/letsencrypt/archive/example1.com/ nicht möglich: Keine Berechtigung
the user mysql still sees nothing. (setfacl --version 2.2.52)
Is there something I missed ?
You need to set the executable bit (x) on the folder as well for a user to be able to actually navigate into the directory. Try the following:
setfacl -m "u:mysql:rx" /etc/letsencrypt/archive/
setfacl -R -m "u:mysql:r" /etc/letsencrypt/archive/*

apache chown on its files not working

My apache user generate one file :
# ls -lsa /tmp/reference_file.csv
76 -rwxrwxrwx 1 apache apache 69921 Aug 16 14:14 /tmp/reference_file.csv
the user and the group belong to apache, but when i am trying to change it :
su -l apache -s /bin/bash
-bash-3.00$ whoami
apache
-bash-3.00$ chown explorer:btunix /tmp/reference_file.csv
chown: changing ownership of `/tmp/reference_file.csv': Operation not permitted
I tried to another folder, but the result was the same, I ve also checked attribut :
# lsattr /tmp/reference_file.csv
------------- /tmp/reference_file.csv
there is no immutable attribut
How can I do ?
Thanks
There are criteria associated with chown. Only super-user can chown files willy-nilly. Whether you can give away a file that you own depends on your UNIX flavor and how associated kernel configuration parameters (like K_CHOWN_MAY_GIVE_AWAY, for argument's sake) may have been, well, configured. This is the most GENERALLY correct answer.

Handling 'Error in exception handler' error in Laravel

I get the "Error in exception handler" error very often, mainly because of file permission issue, and sometimes because of error in code.
I want to redirect user to a custom error page every time the system encounters the 'error in exception handler' error.
How do I handle this error?
It's because Laravel can't write to the logfile. If you don't want logs, you can disable it in app/start/global.php around line 55:
App::error(function(Exception $exception, $code)
{
Log::error(...); //comment out this line.
});
But honestly, that would be a symptom-treatment instead of a problem-treatment. You should chown the app/storage recursively to the user running the server. Fastest way:
In public/index.php, at the very top, temporarily put in die(`whoami`) just after the opening <?php-tag.
Load any page and copy whatever it prints on the site. Let's say it's www-data.
Fire up a terminal/console, go to your project root and run chown www-data -R app/storage, swapping www-data with whatever you found in step two.

Joomla 500 Error

I am trying to log into my Joomla administrator on my Localhost but I keep getting a 500 error.
I've tried loads of things:
Changed file permissions of:
chmod 777 error.php,
chmod 775 cache, logs adminstrator etc
I've tried uncommenting # RewriteBase / in my htaccess
I've changed the path in my configuration.php to:
public $log_path = './logs';
public $tmp_path = './tmp';
I have also checked my apached error logs and it is coming back with the following:
[22-May-2014 14:17:49 Europe/Berlin] PHP Warning: fopen(./logs/error.php): failed to open stream: No such file or directory in /Applications/XAMPP/xamppfiles/htdocs/mydir/libraries/joomla/log/loggers/formattedtext.php on line 248
[22-May-2014 14:17:49 Europe/Berlin] PHP Warning: fputs() expects parameter 1 to be resource, boolean given in /Applications/XAMPP/xamppfiles/htdocs/mydir/libraries/joomla/log/loggers/formattedtext.php on line 254
Any help much appreciated
,
Create the directory
/Applications/XAMPP/xamppfiles/htdocs/mydir/libraries/joomla/log/loggers/logs
Then try again

PHP session handling errors

I have this at the very top of my send.php file:
ob_start();
#session_start();
//some display stuff
$_SESSION['id'] = $id; //$id has a value
header('location: test.php');
And the following at the very top of my test.php file:
ob_start();
#session_start();
error_reporting(E_ALL);
ini_set('display_errors', '1');
print_r($_SESSION);
When the data sends to test.php, the following is displayed:
Array ( )
Warning: Unknown: open(/var/lib/php/session/sess_isu2r2bqudeosqvpoo8a67oj02, O_RDWR) failed: Permission denied (13) in Unknown on line 0
Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in Unknown on line 0
I've tried only using session_start(); but the results are the same.
Look at your message
So first thing it relate to permission
open(/var/lib/php/session/sess_isu2r2bqudeosqvpoo8a67oj02, O_RDWR) failed: Permission denied (13) in Unknown on line 0
you have to check file permission
change mode this /var/lib/php/session/
Second thing it relate to session.save_path
Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in Unknown on line 0
in php.ini
[Session]
; Handler used to store/retrieve data.
session.save_handler = files
; Argument passed to save_handler. In the case of files, this is the path
; where data files are stored. Note: Windows users have to change this
; variable in order to use PHP's session functions.
;
; As of PHP 4.0.1, you can define the path as:
;
; session.save_path = "N;/path"
;
; where N is an integer. Instead of storing all the session files in
; /path, what this will do is use subdirectories N-levels deep, and
; store the session data in those directories. This is useful if you
; or your OS have problems with lots of files in one directory, and is
; a more efficient layout for servers that handle lots of sessions.
;
; NOTE 1: PHP will not create this directory structure automatically.
; You can use the script in the ext/session dir for that purpose.
; NOTE 2: See the section on garbage collection below if you choose to
; use subdirectories for session storage
;
session.save_path = /tmp/ <= HERE YOU HAVE TO MAKE SURE
; Whether to use cookies.
session.use_cookies = 1
you have to change your session.save_path setting to the accessible dir, /tmp/ for example
How to change: http://php.net/session_save_path
Being on the shared host, it is advised to set your session save path inside of your home directory but below document root
also note that
using ob_start is unnecessary here,
and I am sure you put # operator by accident and already going to remove it forever, don't you?
This was a known bug in version(s) of PHP . Depending on your server environment, you can try setting the sessions folder to 777:
/var/lib/php/session (your location may vary)
I ended up using this workaround:
session_save_path('/path/not/accessable_to_world/sessions');
ini_set('session.gc_probability', 1);
You will have to create this folder and make it writeable. I havent messed around with the permissions much, but 777 worked for me (obviously).
Make sure the place where you are storing your sessions isn't accessible to the world.
This solution may not work for everyone, but I hope it helps some people!
You can fix the issue with the following steps:
Verify the folder exists with sudo cd /var/lib/php/session. If it does not exist then sudo mkdir /var/lib/php/session or double check the logs to make sure you have the correct path.
Give the folder full read and write permissions with sudo chmod 666 /var/lib/php/session.
Rerun you script and it should be working fine, however, it's not recommended to leave the folder with full permissions. For security, files and folders should only have the minimum permissions required. The following steps will fix that:
You should already be in the session folder so just run sudo ls -l to find out the owner of the session file.
Set the correct owner of the session folder with sudo chown user /var/lib/php/session.
Give just the owner full read and write permissions with sudo chmod 600 /var/lib/php/session.
NB
You might not need to use the sudo command.
Go to your PHP.ini file or find PHP.ini EZConfig on your Cpanel and set your session.save_path to the full path leading to the tmp file, i.e: /home/cpanelusername/tmp
please make sure the session.save_path is set correctly in the php.ini. php needs read/write access to the directory to which this variable is set.
more information: http://www.php.net/manual/en/session.configuration.php#ini.session.save-path
I had the same error everything was correct like the setting the folder permissions.
It looks like an bug in php in my case because when i delete my PHPSESSID cookie it was working again so aperently something was messed up and the session got removed but the cookie was still active so php had to define the cause differently and checking first if the session file is still they and give another error and not the permission error
When using latest WHM (v66.0.23) you may go to MultiPHP INI Editor choose PHP version and set session.save_path to default i.e. /var/cpanel/php/sessions/ea-php70 instead of previous simple tmp - this helped me to get rid of such errors.
When using the header function, php does not trigger a close on the current session. You must use session_write_close to close the session and remove the file lock from the session file.
ob_start();
#session_start();
//some display stuff
$_SESSION['id'] = $id; //$id has a value
session_write_close();
header('location: test.php');
check your cpanels space.remove unused file or error.log file & then try to login your application(This work for me);
I got these two error messages, along with two others, and fiddled around for a while before discovering that all I needed to do was restart XAMPP! I hope this helps save someone else from the same wasted time!
Warning: session_start(): open(/var/folders/zw/hdfw48qd25xcch5sz9dd3w600000gn/T/sess_f8bgs41qn3fk6d95s0pfps60n4, O_RDWR) failed: Permission denied (13) in /Applications/XAMPP/xamppfiles/htdocs/foo/bar.php on line 3
Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /Applications/XAMPP/xamppfiles/htdocs/foo/bar.php:3) in /Applications/XAMPP/xamppfiles/htdocs/foo/bar.php on line 3
Warning: Unknown: open(/var/lib/php/session/sess_isu2r2bqudeosqvpoo8a67oj02, O_RDWR) failed: Permission denied (13) in Unknown on line 0
Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in Unknown on line 0
I'm using php-5.4.45 and I got the same problem.
If you are a php-fpm user, try edit php-fpm.conf and change listen.owner and listen.group to the right one. My nginx user is apache, so here I change these to params to apache, then it works well for me.
For apache user, I guess you should edit your fast-cgi params refer the two params I mention above.
If you use a configured vhost and find the same error then you can override the default setting of php_value session.save_path under your <VirtualHost *:80>
#
# Apache specific PHP configuration options
# those can be override in each configured vhost
#
php_value session.save_handler "files"
php_value session.save_path "/var/lib/php/5.6/session"
php_value soap.wsdl_cache_dir "/var/lib/php/5.6/wsdlcache"
Change the path to your own '/tmp' with chmod 777.

Resources