Req #80498 [Fbk->Opn]: error log and FPM access log file permissions settings

Edit report at https://bugs.php.net/bug.php?id=80498&edit=1 ID: 80498 User updated by: jordan dot lenuff at gmail dot com Reported by: jordan dot lenuff at gmail dot com Summary: error log and FPM access log file permissions settings -Status: Feedback +Status: Open Type: Feature/Change Request Package: *Configuration Issues Operating System: CentOS 7 PHP Version: 7.4.13 Block user comment: N Private report: N New Comment: Switch to Open status (ommited) Previous Comments: ------------------------------------------------------------------------ [2020-12-09 13:44:19] jordan dot lenuff at gmail dot com Why these files should be readable and/or writable for group depends on individual needs. In my opinion, these files (error log and access) should at least inherit the permissions of the PHP-FPM process (php-fpm:www and 0007 umask in my case). Or better yet : their permissions could be defined by a "log_files_permissions" parameter for example. If the parameter is not defined, they inherit the actual value 0600 and 0644 by default. ------------------------------------------------------------------------ [2020-12-09 09:25:22] requinix@php.net Currently, FPM's access log is hardcoded to 0600 and the general error_log to 0644. https://github.com/php/php-src/blob/PHP-7.4.13/sapi/fpm/fpm/fpm_log.c#L43 https://github.com/php/php-src/blob/PHP-7.4.13/main/main.c#L873 They've both been like that for a very long time so it's hard to say what the reasoning for each choice was, however I would guess the access log is unreadable because it may contain private information? But besides that, why should either file should be *writable* by Group? ------------------------------------------------------------------------ [2020-12-09 08:47:12] jordan dot lenuff at gmail dot com Description: ------------ On several PHP versions, I noticed that error log files do not have correct permissions with PHP-FPM. I did a fresh compilation of 7.4.13 version of PHP with FPM, integrated with systemd, and I don't understand why the error log files permissions are wrong. The files created by PHP scripts have correct permissions, but files created by PHP daemon have wrong permissions. As far as I can search over the net, it's seems PHP does not provide umask configuration for error log files. Test script: --------------- mkdir -p /local/php/php-7.4.13 /local/builds /local/php/sockets /local/php/sessions wget https://www.php.net/distributions/php-7.4.13.tar.gz tar -zxf php-7.4.13.tar.gz -C /local/builds cd /local/builds/php-7.4.13 ./configure \ --prefix=/local/php/php-7.4.13 \ --with-config-file-path=/local/php/php-7.4.13 \ --disable-all \ --enable-fpm \ --with-fpm-user=php-fpm \ --with-fpm-group=php-fpm \ --with-fpm-systemd \ ... and whatever you want && make && make install cp /local/php/php-7.4.13/etc/php-fpm.conf.default /local/php/php-7.4.13/etc/php-fpm.conf cp /local/builds/php-7.4.13/php.ini-production /local/php/php-7.4.13/php.ini echo "[localhost]" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "listen = /local/php/sockets/php-7.4.13_\$pool.sock" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "listen.owner = php-fpm" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "listen.group = www" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "listen.mode = 0660" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "pm = dynamic" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "pm.max_children = 5" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "pm.start_servers = 2" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "pm.min_spare_servers = 1" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "pm.max_spare_servers = 3" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "pm.status_path = /php-fpm-status" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "ping.path = /php-fpm-ping" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "access.log = /data/logs/\$pool/\$pool_php-7.4.13.access.log" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "slowlog = /data/logs/\$pool/\$pool_php-7.4.13.log.slow" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "php_admin_value[error_log] = /data/logs/\$pool/\$pool_php-7.4.13.log" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "php_admin_flag[log_errors] = on" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "php_admin_value[error_reporting] = E_ALL" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "php_admin_value[session.save_path] = \"/local/php/sessions/\$pool/\"" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf echo "php_value[session.save_path] = \"/local/php/\$pool/\"" >> /local/php/php-7.4.13/etc/php-fpm.d/localhost.conf chown -R php-fpm:www /local/php cp /local/builds/php-7.4.13/sapi/fpm/php-fpm.service /usr/lib/systemd/system/php-fpm-7.4.13.service sed -i -e 's/\[Service\]/\[Service\]\nUMask=0007\nUser=php-fpm\nGroup=www/g' /usr/lib/systemd/system/php-fpm-7.4.13.service chmod o+r /usr/lib/systemd/system/php-fpm-7.4.13.service systemctl daemon-reload systemctl start php-fpm-7.4.13.service And then, some Apache configuration to send php files to the PHP socket. Here is the php code to create the test.txt file : <?php $file = '/data/logs/localhost/test.txt'; $current = file_get_contents($file); $current .= "Une ligne\n"; file_put_contents($file, $current); ?> Expected result: ---------------- drwxrwx--- 2 php-fpm www 4096 8 déc. 18:17 . drwxrwxr-x 22 php-fpm www 4096 8 déc. 16:18 .. -rw-rw---- 1 php-fpm www 82004 9 déc. 09:23 localhost_php-7.4.13.access.log -rw-rw---- 1 php-fpm www 312 8 déc. 18:17 localhost_php-7.4.13.log -rw-rw---- 1 php-fpm www 10 8 déc. 18:17 test.txt Actual result: -------------- drwxrwx--- 2 php-fpm www 4096 8 déc. 18:17 . drwxrwxr-x 22 php-fpm www 4096 8 déc. 16:18 .. -rw------- 1 php-fpm www 82004 9 déc. 09:23 localhost_php-7.4.13.access.log -rw-r----- 1 php-fpm www 312 8 déc. 18:17 localhost_php-7.4.13.log -rw-rw---- 1 php-fpm www 10 8 déc. 18:17 test.txt ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=80498&edit=1