Bug #79083 [Opn->Csd]: 7.4.1 does not follow symlinks outside of documentroot while 7.4.0 does

Edit report at https://bugs.php.net/bug.php?id=79083&edit=1 ID: 79083 User updated by: calimeroteknik at free dot fr Reported by: calimeroteknik at free dot fr Summary: 7.4.1 does not follow symlinks outside of documentroot while 7.4.0 does -Status: Open +Status: Closed Type: Bug Package: FPM related Operating System: Linux PHP Version: 7.4.1 Block user comment: N Private report: N New Comment: Yes indeed, this surprise-behaviour was coming from the systemd unit file. So in the end it's much the same as this: http://stackoverflow.com/questions/1038170/mysql-select-into-outfile-tmp-no-output Previous Comments: ------------------------------------------------------------------------ [2020-02-20 10:04:03] jkal at posteo dot eu is it caused by the systemd service that runs php-fpm? around the time of that version change, the following option was added to the service definition on arch linux: ~~~ # The directories /home, /root and /run/user are made inaccessible and empty for processes # invoked by this unit. ProtectHome=true ~~~ there is a similar option for the /tmp directory "PrivateTmp=true". i experienced the behaviour explained in this bugreport, while my symlink pointed into /home. ------------------------------------------------------------------------ [2020-01-27 14:08:54] calimeroteknik at free dot fr From the very beginning I wasn't sure if this was a bug: it might have been intended, although the changelog doesn't mention it. As far as I'm concerned, it's inconvenient to be unable to have symlinks that point outside of the documentroot, and this came specifically from a PHP update. I have no idea how to interpret the "-" for the "%f" field of php-fpm's access.log: at what point did the path become that dash and why? ------------------------------------------------------------------------ [2020-01-26 04:22:08] php-bugs at lists dot php dot net No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. ------------------------------------------------------------------------ [2020-01-21 18:07:42] calimeroteknik at free dot fr Oh wait. I misunderstood. Adding %f to the log format, here are the results: access.format = "%R - %u %t \"%m %r\" %s \"%f\"" The log: - - 21/Jan/2020:19:06:17 +0100 "GET /phpinfo.php" 200 "/srv/http/phpinfo.php" - - 21/Jan/2020:19:06:29 +0100 "GET /symlink.php" 200 "/srv/http/symlink.php" - - 21/Jan/2020:19:06:23 +0100 "GET /symlink2.php" 404 "-" The webserver does not resolve the symlink, but we get "-" logged for %f. ------------------------------------------------------------------------ [2020-01-21 17:59:08] calimeroteknik at free dot fr Here is my test setup: -rw-r--r-- /srv/http/phpinfo.php lrwxrwxrwx /srv/http/symlink.php -> phpinfo.php -rw-r--r-- /tmp/phpinfo.php lrwxrwxrwx /srv/http/symlink2.php -> /tmp/phpinfo.php Here is what access.log produces for the corresponding FPM pool: - - 21/Jan/2020:18:46:42 +0100 "GET /phpinfo.php" 200 - - 21/Jan/2020:18:46:48 +0100 "GET /symlink.php" 200 - - 21/Jan/2020:18:52:20 +0100 "GET /symlink2.php" 404 Clearly, the webserver does not resolve the symlink, and php-fpm chooses to do so only when the target is within the document root, which is known to php-fpm since we see in the log that it has the query string. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=79083 -- Edit this bug report at https://bugs.php.net/bug.php?id=79083&edit=1