Getting PHP upload error 6 because of $HOMEDIR/$user/tmp permissions

mee.feed · March 22, 2021, 9:15am

Hello,

I am getting UPLOAD_ERR_NO_TMP_DIR when I upload files. I think this issue occurs because when adding a user, $HOMEDIR/$user/tmp folder is given a permission of 700 which prevents php to access it.

github.com

hestiacp/hestiacp/blob/main/bin/v-add-user#L98


    setfacl -m "u:$user:r-x" "$HOMEDIR/$user"
fi
setfacl -m "g:hestia-users:---" "$HOMEDIR/$user"

# Building directory tree
mkdir $HOMEDIR/$user/conf

if [ ! -z "$WEB_SYSTEM" ]; then
    mkdir $HOMEDIR/$user/conf/web $HOMEDIR/$user/web $HOMEDIR/$user/tmp
    chmod 751 $HOMEDIR/$user/conf/web 
    chmod 700 $HOMEDIR/$user/tmp
    chown $user:$user $HOMEDIR/$user/web $HOMEDIR/$user/tmp
fi

if [ ! -z "$MAIL_SYSTEM" ]; then
    mkdir $HOMEDIR/$user/conf/mail $HOMEDIR/$user/mail
    chmod 751 $HOMEDIR/$user/mail 
    chmod 755 $HOMEDIR/$user/conf/mail
fi

if [ ! -z "$DNS_SYSTEM" ]; then

I can successfully upload the file if I change the permission to 777 but I don’t want to do that, it will be overridden when rebuilding which, gives it a permission of 771. 771 also, does not work and gives same error, maybe because of user group.

github.com

hestiacp/hestiacp/blob/main/func/rebuild.sh#L124


        >> $HESTIA/data/queue/disk.pipe

    if [[ -L "$HOMEDIR/$user/web" ]]; then
        rm $HOMEDIR/$user/web
    fi
    mkdir -p $HOMEDIR/$user/conf/web/$domain
    mkdir -p $HOMEDIR/$user/web
    mkdir -p $HOMEDIR/$user/tmp
    chmod 751 $HOMEDIR/$user/conf/web
    chmod 751 $HOMEDIR/$user/web
    chmod 771 $HOMEDIR/$user/tmp
    chown --no-dereference $user:$user $HOMEDIR/$user/web
    if [ "$create_user" = "yes" ]; then
        $BIN/v-rebuild-web-domains $user $restart
    fi
fi

# DNS
if [ ! -z "$DNS_SYSTEM" ] && [ "$DNS_SYSTEM" != 'no' ]; then
    mkdir -p $USER_DATA/dns
    chmod 770 $USER_DATA/dns

What could be a proper solution to fix this issue?

Installation Information
Operating system: Ubuntu 20.04 (x86_64)
Install options: --nginx yes --apache yes --phpfpm no --multiphp no --vsftpd yes --proftpd no --named no --mysql no --postgresql no --exim no --dovecot no --clamav no --spamassassin no --iptables yes --fail2ban yes --quota no --api no
Hestia Control Panel: v1.3.4

Thanks.

falzo · March 22, 2021, 11:20am

hey mee.feed,

in scenarios where you do not use multi-php apache runs php as mod/prefork. with that there is a need to tell apache to switch users for the php processes it spawns.

this should be done via mod-ruid2 or alternatively via mpm-itk. I just checked should be available in ubuntu 20.04 - maybe you can verify that at least one of these is installed (dpkg -l).

which apache2-template do you use? something custom? make sure the according directives for either ruid2 or itk are in there. essentially every php process should not run as www-data but instead as the correct user.

that said, you want to make sure that your (php) files truly belong to the correct owner! with I mean, check if you unpacked stuff fro a zip or tgz via shell console as admin/root/whatever, that these files have their owner changed to the proper user they are under. otherwise a working ruid/itk would switch to the wrong user as well, becvause of the wrong owner.

TL;DR; if the file owners are correct and apache has a module to switch to that owner as user, there is no need to adjut permissions on the tmp folder. it will work out of the box.

schiwe · March 22, 2021, 12:35pm

I have the same issue. Hestia should do it automatically?

mee.feed · March 22, 2021, 12:55pm

Hello @falzo

Installing mod-ruid2 with apt install libapache2-mod-ruid2 fixed the issue. Previously apache was opening php files with www-data user.

which apache2-template do you use? something custom?

For testing purpose, I was using the default template but I will be using a custom one and as you said, will make sure that proper directives are placed.

that said, you want to make sure that your (php) files truly belong to the correct owner!

Yes, the files belong to the correct user.

I have another question. I was hesitating to install with --multiphp because I wanted to install/enable only the most required software so that everything is most optimized. Also, I avoid using php-fpm with apache. That’s just my preference.

Thanks for the detailed response.

mee.feed · March 22, 2021, 1:01pm

Hello @schiwe

Just install libapache2-mod-ruid2 it should fix the problem.

apt install libapache2-mod-ruid2

Thanks.

falzo · March 22, 2021, 1:06pm

thanks for reporting back @mee.feed - I guess we need to check, why it wasn’t there in the first place, because it should be part of the regular installation.

however I also remember that it wasn’t available in one distro anymore, deb10/buster probably? we looked into that a while ago at least and made sure itk would still be working instead… I will check the installer, to see if it is still there or where it might be missing.

@schiwe yes it should work automatically with Hestia, but seems it did not get installed on ubuntu 20.04

schiwe · March 22, 2021, 4:06pm

@mee.feed Thanks.

system · April 21, 2021, 4:06pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.