I have two Nextcloud 26 instances running under different PHP FPM pools with a different user. If I now install Apps that come with composer (like recognize and maps) then these apps try (sometimes) to access files from the other Nextcloud instance, what ends, of course, in open_basedir restriction and operation not permitted errors:
file_exists(): open_basedir restriction in effect. File(/home/pool2/nextcloud/apps/maps/vendor/composer/../php-webdriver/webdriver/lib/Exception/WebDriverException.php) is not within the allowed path(s): (/home/pool1/nextcloud:/tmp/:/dev/urandom:/proc) at /home/pool1/nextcloud/lib/composer/composer/ClassLoader.php#511
or
include(/home/pool1/nextcloud/apps/recognize/vendor/symfony/process/ExecutableFinder.php): Failed to open stream: Operation not permitted at /home/pool2/nextcloud/lib/composer/composer/ClassLoader.php#578
It runs on a Debian bullseye with nginx as web server. The configuration of nginx is freshly adopted from the documentation: NGINX configuration — Nextcloud latest Administration Manual latest documentation (only file paths and name of PHP 8.2 pools differ)
The definition of the pools looks like this:
[pool-name]
user = pool1
group = pool1
listen = /run/php/pool1.sock
listen.owner = www-data
listen.group = www-data
pm = ondemand
pm.max_children = 16
pm.process_idle_timeout = 480s;
pm.max_requests = 1000
clear_env = no
php_admin_value[disable_functions] = passthru,system
php_admin_value[open_basedir] = /home/pool1/nextcloud:/tmp/:/dev/urandom:/proc
security.limit_extensions = .php
And the php.ini contains this:
[PHP]
user_ini.filename =
engine = On
short_open_tag = Off
precision = 14
output_buffering = off
implicit_flush = Off
unserialize_callback_func =
serialize_precision = -1
disable_functions =
disable_classes =
zend.enable_gc = On
zend.exception_ignore_args = On
zend.exception_string_param_max_len = 0
expose_php = Off
max_execution_time = 180
max_input_time = 180
memory_limit = 1G
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
display_errors = Off
display_startup_errors = Off
log_errors = On
ignore_repeated_errors = Off
ignore_repeated_source = Off
report_memleaks = On
variables_order = "GPCS"
request_order = "GP"
register_argc_argv = Off
auto_globals_jit = On
post_max_size = 2G
auto_prepend_file =
auto_append_file =
default_mimetype = "text/html"
default_charset = "UTF-8"
doc_root =
user_dir =
enable_dl = Off
file_uploads = On
upload_max_filesize = 2G
max_file_uploads = 20
allow_url_fopen = On
allow_url_include = Off
default_socket_timeout = 360
[CLI Server]
cli_server.color = On
[Date]
[filter]
[iconv]
[imap]
[intl]
[sqlite3]
[Pcre]
[Pdo]
[Pdo_mysql]
pdo_mysql.default_socket=
[Phar]
[mail function]
SMTP = localhost
smtp_port = 25
mail.add_x_header = Off
mail.mixed_lf_and_crlf = Off
[ODBC]
odbc.allow_persistent = On
odbc.check_persistent = On
odbc.max_persistent = -1
odbc.max_links = -1
odbc.defaultlrl = 4096
odbc.defaultbinmode = 1
[MySQLi]
mysqli.max_persistent = -1
mysqli.allow_persistent = On
mysqli.max_links = -1
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off
[mysqlnd]
mysqlnd.collect_statistics = Off
mysqlnd.collect_memory_statistics = Off
[OCI8]
[PostgreSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = 0
pgsql.log_notice = 0
[bcmath]
bcmath.scale = 0
[browscap]
[Session]
session.save_handler = files
session.use_strict_mode = 0
session.use_cookies = 1
session.use_only_cookies = 1
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.cookie_httponly =
session.cookie_samesite =
session.serialize_handler = php
session.gc_probability = 0
session.gc_divisor = 1000
session.gc_maxlifetime = 1440
session.referer_check =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0
session.sid_length = 26
session.trans_sid_tags = "a=href,area=href,frame=src,form="
session.sid_bits_per_character = 5
[Assertion]
zend.assertions = -1
[COM]
[mbstring]
[gd]
[exif]
[Tidy]
tidy.clean_output = Off
[soap]
soap.wsdl_cache_enabled=1
soap.wsdl_cache_dir="/tmp"
soap.wsdl_cache_ttl=86400
soap.wsdl_cache_limit = 5
[sysvshm]
[ldap]
ldap.max_links = -1
[dba]
[opcache]
opcache.enable=1
opcache.enable_cli=0
opcache.memory_consumption=8192
opcache.interned_strings_buffer=256
opcache.max_accelerated_files=1000000
opcache.max_wasted_percentage=5
opcache.validate_timestamps=1
opcache.revalidate_freq=0
opcache.save_comments=1
[curl]
[openssl]
[ffi]
What is wrong with my configuration that composer tries to find files on a complete different path? Thanks for any suggestions.
