[php-src] Issue #12838: [SOAP] Temporary WSDL cache files not being deleted
| From: | Lyrkan | Date: | Thu, 30 Nov 2023 14:58:49 +0000 |
| Subject: | [php-src] Issue #12838: [SOAP] Temporary WSDL cache files not being deleted | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-245943@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/12838
Author: Lyrkan
### Description
Hi there,
After upgrading some servers from PHP 8.1.25 to 8.1.26 I started receiving alerts that their disk
usage was increasing unusually fast due to thousands of
tmp.wsdl.* files being created
in the WSDL cache folder.
From what I've seen those temporary files were added in #12469 but I think it may be related to
another issue I had before.
PHP scripts from my app are owned by an user called admin and may be executed by two
different users :
* admin (CLI)
* www-data (PHP-FPM).
In both cases SOAP APIs may be called which will result in the WSDL cache being populated.
From my understanding, the filenames for those files depend on a
[php_get_current_user()](https://github.com/php/php-src/blob/f3ece813ff9b4f114267e213120de63d2c392ce0/ext/soap/php_sdl.c#L3231)
call which doesn't return the process owner but the owner of the script, which means that in
both cases (CLI or PHP-FPM) the files will have the same name.
Since - at least in my case - they are created in the /tmp directory with
600 permissions, only the owner of the process that was used to create them can also
read them. So, I basically end-up with files called wsdl-admin-* owned by the first
user that populated the WSDL cache (ex: admin) and not readable by the other one (ex:
www-data). I'm not sure why it worked before 8.1.26, I'm guessing that it
probably didn't but failed silently.
What I'm guessing happens next is that the new code from #12469 tries to move the
tmp.wsdl.* files to wsdl-admin-<hash> but does not have the
persmission to do so.
So, two questions:
* is there a reason the cache files are named based on the script file owner and not the PHP process
owner?
* shouldn't the tmp.wsdl.* files be removed if they could not be renamed?
### PHP Version
PHP 8.1.26
### Operating System
Ubuntu 20.04