[NC18] Problem to access data folder after upgrade to php 7.4

ℹ️ Support
5

Hi @Schmu,

Sure.

With php 7.4.0 they implemented PHP :: Request #72510 :: systemd service should be hardened to hardened php-fpm service unit.

The php-fpm systemd service, php-fpm.service, should use be hardened as much as possible against potential attacks. Besides reducing the likelihood of an attack, if php does get compromised, there will be less damage possible.

So these are the new options in the php-fpm systemd unit:

PrivateTmp=true

ProtectHome=true

ProtectSystem=full

PrivateDevices=true

ProtectKernelTunables=true

ProtectControlGroups=true

RestrictNamespaces=true

That’s why in this comment https://bugs.archlinux.org/task/64689#comment184108 they said to add ReadWritePaths to the unit because of the protectSystem set to true.

This parameter mounts the /usr and /boot directories read-only for processes invoked by this unit.

So to keep write access to directories in the /share/webapps folder you hate to explicitly give write access to the folder with ReadWritePhths editing php-fpm service (systemclt edit php-fpm.service). So it should look like this on archlinux (nextcloud is installed in /usr/share/webapps)

[Service]
ReadWritePaths = /usr/share/webapps/nextcloud/data
ReadWritePaths = /usr/share/webapps/nextcloud/apps
ReadWritePaths = /etc/webapps/nextcloud/config/

This pointed me in the good direction to go and look the new systemd unit.

Because my nextcloud install is manual and not via pacman, my data directory is on my /home partition.

So the new option ProtectHome=true was the problem.

As said in the systemd documentation

If true, the directories /home , /root , and /run/user are made inaccessible and empty for processes invoked by this unit.

That’s why my folder /home/nextcloud was not anymore accessible to php-fpm.
To avoid this block, the documentation says you explicitly have to give acces to the home folder.
The way to do it is to give tmpfs parameter and give the path with BindPaths.

The value " tmpfs " is useful to hide home directories not relevant to the processes invoked by the unit, while still allowing necessary directories to be made visible when listed in BindPaths= or BindReadOnlyPaths= .

That’s why my new systemd unit looks like this to give access to the /home/nextcloud folder.

[Service]
ProtectHome=tmpfs
BindPaths=/home/nextcloud/

Systemd documentation used: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
I hope everything is understandable :slight_smile:

So the problem was not nextcloud 18.0.0 RC1 but update to php7.4, shoud I change the title of the post?