Bug #76573 [Opn]: Log file is created with wrong permissions if deprecated configuration found

Edit report at https://bugs.php.net/bug.php?id=76573&edit=1 ID: 76573 Updated by: ab@php.net Reported by: mbiebl at messageconcept dot com Summary: Log file is created with wrong permissions if deprecated configuration found Status: Open Type: Bug Package: IIS related Operating System: Windows Server 2016 PHP Version: 7.2.7 Block user comment: N Private report: N New Comment: There seems no good way to solve this issue. Perhaps, one could temporarily redirect all the logging to syslog while in the startup phase. I had a partial try on that and it seems like it could work. But that way the information would go into a non obvious location where error_log where configured to be a file. Another idea were to touch the error log file with permissions for IUSRS after the startup was done. Here is the obvious issue, that we can't reliably determine whether the FCGI process indeed runs under IIS. Even if fastcgi.impresonate is set. Another solution that should work better is to use some path outside c:\windows\temp. The permission issue exists, because any file inside c:\windows inherits very strict permissions. Once the log file was created as system, an impersonated process won't be able to access it because the created file inherits the security attributes from c:\windows. Putting the log file into some other location with less strict permissions would solve this. Otherwise I would say it is a documentation issue. I think, c:\windows should not be used for any writing operations anyway. The solution would be either usisg syslog or using a path outside c:\windows with a bit more lose permissions. @mbiebl btw the syslog issues should be fixed now. Not sure they're released yet, but the latest snapshots should be fine in that regard. Thanks. Previous Comments: ------------------------------------------------------------------------ [2018-07-05 21:31:26] mbiebl at messageconcept dot com Hi Anatol, I'd say let's focus on the issue at hand in this bug report. If I find time to generate a backtrace I'll file a separate bug report for the php-cgi.exe crash ------------------------------------------------------------------------ [2018-07-05 21:01:19] ab@php.net Or some relevant configs, at least. Thanks. ------------------------------------------------------------------------ [2018-07-05 21:00:14] ab@php.net @mbiebl could you please share a backtrace or a crash dump from the case the syslog scenario crashes? See https://bugs.php.net/bugs-generating-backtrace-win32.php Thanks. ------------------------------------------------------------------------ [2018-07-05 20:18:32] spam2 at rhsoft dot net well, having logfiles in C:\Windows\temp\PHP72_errors.log must be a Windows attitude, i am out here... ------------------------------------------------------------------------ [2018-07-05 20:17:03] mbiebl at messageconcept dot com Well, even if I pre-create the log file somehow (say in the application installer), it's not unthinkable that the admin cleans up C:\Windows\Temp at some point (along with the log file). So I'd need a separate daemon which is running all the time and watches C:\Windows\Temp and immediately re-creates the file. Otherwise, on the next connection attempt the file will be created by php with the wrong permissions again leading to a very hard to debug problem for the admin. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=76573 -- Edit this bug report at https://bugs.php.net/bug.php?id=76573&edit=1