Open_basedir restriction after update to 26

ℹ️ Support
22

I added /proc/ and no more errors appear in the log.

Details:
We’re on shared hosting and unable to edit php.ini directly. But in DirectAdmin there is an app ‘PHP Selector’ where you can select extensions and set options. The open_basedir field looks empty when I click ‘reset to default’ but from the error I concluded that the default is:

/home/<account>/:/tmp:/var/tmp:/opt/alt/php74/usr/share/pear/:/dev/urandom:/usr/local/lib/php/:/usr/local/php74/lib/php/

So i filled the field with:

/home/<account>/:/tmp:/var/tmp:/opt/alt/php74/usr/share/pear/:/dev/urandom:/usr/local/lib/php/:/usr/local/php74/lib/php/:/proc/
24

I have exactly the same error as @camouflage81, no problems with it on my end either until Nextcloud version 25.0.6.

Details about my installation:
Nextcloud version: 26.0.1
Webhosting provider: netcup
PHP Memory Limit: 512 MB
PHP Upload Filesize: 128 MB
Apache or nginx version: Apache/2
PHP version: 8.1.17
Operating system: Linux 4.19.0-21-amd64 x86_64
Processor: Unknown processor (display under Nextcloud System) possibly a cause?!
Hard disk shared: sda3
Mount: /
File system: ext4
Size: 4.15 TB
Available: 755.83 GB
Used: 83% (3.41 TB)

As recommended by @ernolf, I have run the commands.
php -d memory_limit=512M /httpdocs/xxxxxxxx/nextcloud/nproc.php
Hardware concurrency: 0
php -r “echo function_exists(‘exec’) ? ‘exec is available’ . PHP_EOL : ‘exec is not available’ . PHP_EOL;”
exec is available

Special feature since version 26 in the System section:
Besides my personal IPv4 and IPv6 address, about 360 other IPv6 addresses are now displayed.
Does this mean that I share the storage with 360 other netcup users?

Following @ernolf’s instructions, I modified the “./lib/private/Preview/Generator.php” file and the error no longer occurs.

25

I also host with netcup.
I hope that I can test it tonight as well.

26

I have already read your post in the netcup forum.

The file “data.config.php” in the config directory is absolutely necessary at netcup in the web hosting, because the occ commands in the SSH access do not work properly otherwise.

My file is structured as follows, because I still refer to the tmp directory in other installations.

<?php
$CONFIG =
[
	'datadirectory' => realpath(__dir__ . '/../data'),
];

Alternatively with tmp directory:

<?php
$CONFIG =
[
	'datadirectory' => realpath(__dir__ . '/../data'),
	'tempdirectory' => realpath(__dir__ . '/../data/tmp'),
];

Maybe it helps other users here with similar problems.

27

I just did that.

1 Like
28

This solution works for us. A Pull request is in the making.

Others are confirming what @ernolf states above: from a NC perspective it is OK to turn off open_basedir. In plesk or cPanel you can by setting it to none if your provider allows. In DirectAdmin it is always admin-only AFAIK.

But it might break other applications, like old WordPress plugins.

Edit: the first PR was closed, a new one is waiting for review.

29

Thank you very much. I moved the nproc.php to the right place and now I get

sh: nproc: command not found
Hardware concurrency: 0

Exec is available and since I edited the Generator.php I didn’t get the “open_basedir” error. Although I don’t seem to have a CPU and nproc command…

30

What is your platform?
Looks like nproc is not available on your system. (Find out with which nproc)

but that shouldn’t be a problem, because a solution is already being developed that doesn’t need it.

31

With your code under New: the error goes away for us (shared hosting on CentOS, Litespeed, DirectAdmin) but Nextcloud Files gets a little sluggish. The list of files appears slower.

If your in a Plesk environment (or cPanel, DirectAdmin) there probably is no console…

But cloud.mydomain.tld/nproc.php results in:

Hardware concurrency: 0

From an info panel in WordPress on the same host I know we’re on a 10 core Xenon Silver.

32

This means the function does not work on your system. The fact that the error message is gone does not mean that the alternative works with all those restrictions!
If I were you, I would wait a little longer until a new patch was issued that generally solves this or look around for a proper hosting alternative. I honestly wouldn’t even consider such shared hosting from the start, it would drive me crazy.

33

The nice thing about shared hosting is that the number of cores in the CPU doesn’t change very often. So Nextcloud should not have to check that on every preview :smiling_imp:

But more serious: the official Nextcloud documentation provides information on how to install it on shared hosting and the website promotes a web installer (under Community projects). We get some warnings in Administration > Overview like ‘PHP modules “gmp” and/or “bcmath” are not enabled’ but nothing about open_basedir settings.

Also many hosting providers offer a tool called Installatron that helps installing AMP application with limited technical knowledge.

The problem is that many regulars in the community are running their own dedicated server and are looking down on shared hosting or Docker / Snap variaties.

I’m running it on my own Ubuntu server at home for personal use but since a year also on shared hosting for two associations where I’m a volunteer webmaster. It has worked very well to keep data centralized and control access. Otherwise teams and committees will spread data over ad hoc Dropbox en Google drive groups with all the related GDPR problems.

We only use Nextcloud files, < 50 users, a few hundred documents. The backup solution included with Installatron works fast and easy, a lot better than the ‘official’ Nextcloud Backup app.

It is also in the commercial interest of Nextcloud to make and keep it working well on shared hosting. Members of these associations work for companies or own them. A commercial Nextcloud provider already got a paying customer because saw how I made it work. Likewise MailPoet and Woocommerce got new customers this way.

34

Then you can help with your experience expertise to make things better :+1:

35

Yes willemb2 this fix solves the problem

Check for open_basedir before reading /proc #37959

3 Likes
36

Still occours in Nextcloud 26.0.2

Would be nice to add this fix for Nextcloud 26.0.3 and not later in 27.x.
Or should be backported.

Great thanks.

37

Unfortunately, the error still occurs in Nextcloud 26.0.4 and Nextcloud 27.0.1.

If I understand it correctly, the solution to this problem is postponed to Nextcloud 28.
https://github.com/nextcloud/server/pull/37959#pullrequestreview-1406699312

Anyway, with the fix from @anon78853765’s post it works very well for me.

38

@camouflage81 We just moved to another hosting that is using Plesk. A simple workaround on Plesk is by going to Websites & Hosting > PHP Settings and add {:}/proc/ to the open_basedir field. In our case the default was {WEBSPACEROOT}{/}{:}{TMP}{/} and I changed that to {WEBSPACEROOT}{/}{:}{TMP}{/}{:}/proc/

As I understand it there are 2 competing PR’s being discussed now on Github:

Check for open_basedir before reading /proc by solracsf · Pull Request #37959 · nextcloud/server · GitHub (already mentioned above)

and

In my experience, for small scale Nextcloud setups on shared hosting the only issue is the flood of open_basedir restriction errors in the log. We encourage our (35) users to only use the clients and we’re not seeing any performance issues.

39

The error has now been corrected in Nextcloud Hub 6 (27.1.4).
A modification of the file “Generator.php” is no longer necessary.

In Nextcloud Hub 4 (26.0.9) the error is unfortunately still present.
For Nextcloud to function correctly in web hosting, the “Generator.php” file must unfortunately still be modified.

Change in the code of the file lib/private/Preview/Generator.php from line 351

Remove:

			if (is_file("/proc/cpuinfo")) {
				$width = substr_count(file_get_contents("/proc/cpuinfo"), "processor");

Insert:

			if (function_exists('ini_get')) {
				$openBasedir = ini_get('open_basedir');
				if ($openBasedir == '') {
					$width = is_readable('/proc/cpuinfo') ? substr_count(file_get_contents('/proc/cpuinfo'), 'processor') : 0;
				} else {
					$openBasedirPaths = explode(':', $openBasedir);
					foreach ($openBasedirPaths as $path) {
						if (strpos($path, '/proc') === 0 || $path === '/proc/cpuinfo') {
							$width = is_readable('/proc/cpuinfo') ? substr_count(file_get_contents('/proc/cpuinfo'), 'processor') : 0;
						} else {
							$width = 0;
						}
					}
				}
1 Like