2

How could I set default permissions for session files so that both apache-php-process and some-other-user's-php-process can rw them? The session is created by some-other-user's-php-process and after that apache-php-process should be able to read and write it.

Now the default permission for session files is 600. It should be 660 or 666. Where and how can I set this permission (eg. httpd.cond or php.ini)? So that no need to use chmod every time after session_start().

The server is my own, so no need to avoid this for security reasons.

Apache version is 2.2.15, php is 5.3.3, server is Centos6 64-bit.

And because first question is: why do you need this, I answer to this first: I have build few sites with suphp on the server and the logic is build over this, so there are tens of calls to session_start() and all php-processes are owned by some specific user. I have a getimage.php, which loads images, in some page there can be tens or hundreds of thumbnails on the same page (I want it this way!). Although I have 100M internet, the page loads slowly because of every call to getimage.php, new php-process is started. getimage.php uses sessions for restricting user access to specific images. I tested to create an Apache handler for php and use different file extension for this: getimage.apachephp. The speedup was huge! But the problem is that I have manually chmod the session file to allow apache-php-process to access the session file. And I thought that if chmod could be made automatically in every session file creation, the process becomes more meaningfull.


EDIT: One possible solution is to use

session_save_path("0;666;/path/to/sessfile");
umask(0);
session_start();

Or if you want to avoid 666 and use a little more secure 660, both apache-user and suphp-user have to belong into same group eg. web and after session is created to change group of created session file to web. I selected 666 for simplicity.

2 Answers 2

1

I know it's an old question...

I believe you still have to set the umask for the apache user. (i.e., the new save_path is actually trying to set the file to 660 but the umask won't allow it).

You just need to edit/add:

echo "umask 0002" >> /etc/apache2/envvars  (Debian)
echo "umask 0002" >> /etc/sysconfig/httpd  (CentOS)

Then restart the service (a graceful reload won't work).

service httpd restart

Regarding the save_path variable, I didn't do it at run time, but I changed the php.ini, adding:

session.save_path = "0;660;/var/lib/php5"
1
  • Fantastic solution!
    – Yes Barry
    Feb 14, 2020 at 21:56
0

The easiest solution would be to change session handler in PHP to use a database instead of files. There are some examples of this available on the Internet.

3
  • Maybe database is not easiest, if we take into account that custom handling functions and database has to be created and in addition to that also existing code has to be changed. The one of the easiest methods would be changing ini ini_set("session.save_path", "0;666;/path"), but for some reason this does not work. The session file has 600, although it should be 666. Mar 10, 2013 at 10:13
  • @Timo: Are you sure it should work like this? It would be a feature that is not documented in PHP Runtime Configuration.
    – Tometzky
    Mar 10, 2013 at 12:45
  • I tested and with umask(0) it worked. The odd thing is that the only place where this is explicated is php.ini. Mar 10, 2013 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .