php script can't access /tmp folder

Question

I have no open_basedir, php can access /etc /usr /proc /home etc… but not /tmp.

tmpfs is mount on /tmp (/tmp type tmpfs (rw)) That's also the reason I want to use the /tmp folder.

My files are owned by http (user for nginx and php) and readable by everyone.

sudo -u http cat /tmp/file is working but anything inside a php script does not (like file_exist() or file()).

edit : the error show in log :

PHP Warning: file(/tmp/ydlw/pid): failed to open stream: No such file or directory in /srv/http/ydlw/status.php on line 267 

edit2: I tested the issue the other way. I made

touch("/tmp/boo"); file_exist("/tmp/boo"); 

and file_exist return true so the file is created. Then I watched inside /tmp and no "boo" file can be found there. That's what I was afraid, php do not «see» the mount point. Why is that and how can I fix that ?

Answer 1

I found off why, well, someone gave me the global hint.

It's neither the fault of php or tmpfs. The culprit was systemd and his security system PrivateTmp.

For those who get in the same issue that I did, the service php (and probably some others) have the PrivateTmp option to true in the systemd script (/usr/lib/systemd/system).

In that case, a new /tmp is created and isolated from the other one. All the data save inside are deleted once the service is stopped.

It's a security measure since /tmp can contain a lot a sensitive informations and php script are not always secure.

To deactivate this, simply copy the script inside /etc/systemd/system (to avoid overwriting of your changes after an update) and set PrivateTmp to false.

You can also set two or more services to share the same /tmp using JoinsNamespaceOf.

For more information > man systemd.exec

Answer 2

I know, I'm quite late to the show, but I'm currently working on this as well, that's why I want to add an idea. Like @eephyne wrote, PrivateTmp is s security measure, to turn it off is possibly not the best choice. To overcome the problem, that one service can not access files in /tmp of another service, systemd offers the JoinsNamespaceOf= option. By using this, we can define services, that share /tmp, /var/tmp ... but are seperated from /tmp of other services.

To add JoinsNamespaceOf= to the systemd units, do not edit the unit files directly, always use systemctl edit ... to avoid confusion on OS updates.