Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder:

"2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning:
    Unknown: open(/var/lib/php/session/sess_cskfq4godj4ka2a637i5lq41o5, O_RDWR)
    failed: Permission denied (13) in Unknown on line 0
PHP Warning:  Unknown: Failed to write session data (files). Please verify
    that the current setting of session.save_path is correct
    (/var/lib/php/session) in Unknown on line 0" while reading upstream"

Obviously this is a permission issue; my session folder's owner/group is the webserver's user, NGINX. PHP-FPM runs as nobody though, and hence adding it to the nginx group is not so trivial.

A temporary solution is to set the permissions of /var/lib/php/session to 777 - I have a feeling that's not the "best practice" though.

What is the best practice when you need to assign a daemon write access to a folder, but it is running as nobody ?

share|improve this question

4 Answers 4

The correct permissions for us where

chown -R nobody:nogroup /var/lib/php/session

as php-cgi runs as nobody, even though NGinx runs as user nginx

share|improve this answer

Use /etc/php.ini session.save_path directive.

A temporary solution is to set the permissions of /var/lib/php/session to 777 - I have a feeling that's not the "best practice" though.

"If you leave this set to a world-readable directory, other users on the server may be able to hijack sessions by getting the list of files in that directory. "

share|improve this answer
    
Sorry I think I may not have been clear: session.save_path is already set to /var/lib/php/session . The problem is I can't figure out what permissions and ownership to assign to the session path directory in order to both enable PHP-FPM to write to it, as well as keep it safe. Having the directory set as owner/group "nginx"(The web server I'm running) and permissions 755 doesn't seem to do the trick –  Professor Frink Oct 2 '09 at 12:17
2  
1. Use same user:group for nginx and php-fpm (via either nginx.conf or php-fpm.conf), so you can keep this directory 700. 2. Use chown -R nginx:nobody /var/lib/php/session && chmod -R 770 /var/lib/php/session so i think both nginx and php-fpm can use it –  SaveTheRbtz Oct 2 '09 at 14:32
2  
I can confirm that using nginx:nobody (or nginx:nogroup in some circumstances) works. If it is possible, I'd lean towards SaveTheRbtz' option 1, though. –  Michael Johnson Oct 22 '09 at 3:24

I had the same problem and I solved it. I went to /tmp (that's where my ses_* files are) and deleted them all. After that everything was OK.

As nears as I could tell the system was trying to write on old locked files.

The problem occured after I was playing with php.ini. I lost a couple years from my life but eventually I found the solution.

share|improve this answer

I had to create folder with 0700 rights in /var/lib/php/session for each php-fpm pool.

Owner of this folder is user and group from php-fpm pool.

And /var/lib/php/session now 0777.

I think this method is most secure. Only php-fpm pool user will see this sessions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.