Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im trying to setup Apache + FastCGI + chrooted PHP-FPM on Debian (wheezy). But I'm always geting file not found error. I cannot find the problem, but if I disable chroot, everything runs fine. What I'm trying to accomplish is that I want to forbid users from seeing files that are not in their webroot (other users files).

Here are relevant config files:

/etc/apache2/mods-available/fastcgi.conf

<IfModule mod_fastcgi.c>
  #FastCgiWrapper /usr/lib/apache2/suexec
  #FastCgiIpcDir /var/lib/apache2/fastcgi
  FastCgiIpcDir /var/www/domain.com/var/run/php5-fpm

  <FilesMatch \.php$>
    SetHandler php5-fcgi
  </FilesMatch>

  Action php5-fcgi /php5-fpm

  <Location "/php5-fpm">
    Order Deny,Allow
    Deny from all
    Allow from env=REDIRECT_STATUS
  </Location>

</IfModule>

/etc/apache2/sites-available/pma.domain.com

<VirtualHost *:443>
  ...

  # Index file and Document Root (where the public files are located)
  DirectoryIndex index.html index.php
  DocumentRoot /var/www/domain.com/subdomains/pma

  # FastCGI
  Alias /php5-fpm /var/www/domain.com/subdomains/pma/php5-fpm
  FastCgiExternalServer /var/www/domain.com/subdomains/pma/php5-fpm -socket domain.com.sock -pass-header Authorization

  ...
</VirtualHost>

/etc/php5/fpm/pool.d/domain.com.conf

[domain.com]

prefix = /var/www/$pool

user = domain
group = domain

listen = var/run/php5-fpm/$pool.sock

listen.owner = domain
listen.group = www-data
listen.mode = 0660

...

chroot = $prefix

I also tried to strace php-fpm worker threads and this is what I got:

DOCUMENT_ROOT=/var/www/domain.com/subdomains/pma
SCRIPT_FILENAME=/var/www/domain.com/subdomains/pma/php5-fpm
REDIRECT_URL=/index.php
REQUEST_URI=/
SCRIPT_NAME=/php5-fpm
PATH_INFO=/index.php
PATH_TRANSLATED=/var/www/domain.com/subdomains/pma/index.php
Primary script unknown
share|improve this question
    
not on debian (it worked on RHEL/CentOS/Amazon linux) but this might give you couple of hints of files needed for chroot github.com/kinesis/chroot-jailer/blob/master/chroot.sh –  golemwashere Sep 29 at 21:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.