4

I have several users running PHP scripts on a server and I'd like to lock it down so that their scripts can only access files in their www directory (it doesn't use linux user accounts, so there isn't a home directory).

open_basedir seems like the obvious choice but how can I set that parameter based on where the script is running from? Obviously the value for open_basedir would be different for each user.

I'm running PHP5-FPM - PHP5 as a FastCGI process which nginx connects to - on Ubuntu 11.04

Any help or advice appreciated!

2 Answers 2

4

I've discovered the solution - php.ini directives based on the file path or request host. From the documentation:

[HOST=dev.site.com]
open_basedir = /var/www/dev.site.com

or

[PATH=/var/www/dev.site.com]
open_basedir = /var/www/dev.site.com
1

Assuming you're using Apache, you should be able to set it within each VirtualHost instance with:-

php_admin_value open_basedir /path/to/restrict/to

Resist the temptation to use ., as the user can still change directory with chdir.

http://php.net/manual/en/ini.core.php has a bit more information, too.

1
  • 1
    Unfortunately I'm running PHP as a FastCGI process and connecting to it with nginx. I've updated my question just to clarify
    – Tak
    Nov 30, 2011 at 22:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .