Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup a site inside of a PHP-FPM chroot. My paths are as follows:

chroot = /var/www/
chdir = www/

The chroot works just fine without chdir. But when I add chdir I get this error on php-fpm startup:

ERROR: [pool www] the chdir path '/usr/www/' within the chroot path '/var/www/' ('/var/www///usr/www/') does not exist or is not a directory

Anybody know why it would append /usr/ to the chdir path? Is there a way to remove it from that path?

Also, if I change the chdir path to /www/, I have to browse to http://localhost/www/filename.php to see my file. Isn't the point of chdir to make that unnecessary?

share|improve this question

2 Answers 2

Have you actually prepared a proper chroot for PHP?

Simply setting an arbitrary directory is not enough - you actually need to build the chroot and ensure it includes all necessary libraries, devices and binaries.

Otherwise, basic things like DNS resolution will fail to work and you'll get random errors, hangs or app segfaults. It sounds like you are mistaking the simplicity of open_basedir with that of a chroot.

As a start, this script, once customized, should give you a basis for a chroot.

http://www.fuschlberger.net/programs/ssh-scp-sftp-chroot-jail/make_chroot_jail.sh

But realistically, if you don't have much experience with chroots ...

  1. It may not be any more secure than normal if incorrectly set up
  2. It may be far more insecure than normal and could allow root escalation if incorrectly set up
  3. You could end up with random issues, that will plague your application over time all caused by a badly built chroot

I would guess security is your goal, but you're very likely to end up with the exact opposite.

share|improve this answer
    
I don't know if you're familiar with PHP-FPM's chroot option or not, but it's not a REAL chroot in the normal meaning of chroot. The chroot under PHP-FPM just specifies that PHP cannot break out of that folder. serverfault.com/questions/344538/… –  tubaguy50035 Sep 20 '12 at 21:45
    
I'm very familiar with it (we are a web hosting firm) that owns and manages hundreds of servers all running php-fpm. Its still a chroot, and it still requires everything that a normal chroot requires. That includes libraries, binaries and devices. Sure, on the surface it will appear to work, but you'll soon notice DNS won't resolve, encoding types can't be converted, SSL extensions don't work as they should, email isn't sent, MySQL connections have issues etc. –  Ben Lessani - Sonassi Sep 20 '12 at 21:50
    
And I'm prepared to deal with all of those issues as they come. But your answer does not answer my question. If you have hundreds of servers, I'd much rather hear your experience rather than being told I'm doing a bad thing by looking into this. My question is specifically about the chdir directive. Your answer does not address that unless you're saying chdir does not work because the chroot has been setup improperly. –  tubaguy50035 Sep 20 '12 at 21:56
    
Have you actually prepared a proper chroot for PHP? That's your answer. You already are dealing with issues as they come, this is your first. I also gave a thorough explanation as to why you should question doing what you are doing, to better guide you into making an appropriate decision. I then proceeded to provide a link that will give you a starter into preparing a chroot. Since every chroot is different and so are their purposes, there is no definitive guide for you to follow. You add what you need to the chroot, no more, and only you know what you need. –  Ben Lessani - Sonassi Sep 20 '12 at 22:01
    
That's not an answer. That's a question. I asked a specific question about the chdir directive under FPM. If you have knowledge about that, I'd love to hear it. –  tubaguy50035 Sep 20 '12 at 22:02
up vote 0 down vote accepted

Got help from phpfreaks IRC last night. It was an issue on the Apache side that I needed it to send the "/www" to PHP-FPM.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.