Still strange files in the installation root. Inkscape-ImageMagick

pmhausen · October 30, 2025, 12:09pm

Support intro

Sorry to hear you’re facing problems.

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

Official documentation (searchable and regularly updated)
How to topics and FAQs
Forum search

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can.

The Basics

Nextcloud Server version (e.g., 29.x.x):
- 31.0.9
Operating system and version (e.g., Ubuntu 24.04):
- FreeBSD 14.3
Web server and version (e.g, Apache 2.4.25):
- NginX 1.28.0
Reverse proxy and version _(e.g. nginx 1.27.2)
- none
PHP version (e.g, 8.3):
- 8.2.29 with PHP-FPM
Is this the first time you’ve seen this error? (Yes / No):
- no
When did this problem seem to first start?
- Netcloud 30
Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
- regular Nextcloud source --> document root
Are you using CloudfIare, mod_security, or similar? (Yes / No)
- no

Summary of the issue you are facing:

Referring to Strange files in root we still have files with names starting with “-” or “@” and occasionally a file named “(null)” appearing in the install root.

All these files contain a single line:

sh: inkscape: Permission denied

Steps to replicate it (hint: details matter!):

Difficult - run Nextcloud in the environment described above. I have about a dozen installations and all show this behaviour.

I created this new thread, because I can add some debug information. Maybe someone knowing the internal architecture can pinpoint what might cause this behaviour.

I used ktrace to log all system calls made by php-fpm and all its descendants.

It all starts with PHP receiving this response from a file descriptor, probably from the database?

 38140 php-fpm  GIO   fd 5 read 1242 bytes
       0x0000 0100 0001 0441 0000 0203 6465 6609 6e65 7874 636c 6f75 640c 6f63 5f61 7070 636f  |.....A....def.nextcloud.oc_appco|
       0x0020 6e66 6967 0c6f 635f 6170 7063 6f6e 6669 6705 6170 7069 6405 6170 7069 640c 2d00  |nfig.oc_appconfig.appid.appid.-.|
       0x0040 8000 0000 fd83 4000 0000 4900 0003 0364 6566 096e 6578 7463 6c6f 7564 0c6f 635f  |......@...I....def.nextcloud.oc_|
       0x0060 6170 7063 6f6e 6669 670c 6f63 5f61 7070 636f 6e66 6967 0963 6f6e 6669 676b 6579  |appconfig.oc_appconfig.configkey|
       0x0080 0963 6f6e 6669 676b 6579 0c2d 0000 0100 00fd 8340 0000 004d 0000 0403 6465 6609  |.configkey.-.......@...M....def.|
       0x00a0 6e65 7874 636c 6f75 640c 6f63 5f61 7070 636f 6e66 6967 0c6f 635f 6170 7063 6f6e  |nextcloud.oc_appconfig.oc_appcon|
       0x00c0 6669 670b 636f 6e66 6967 7661 6c75 650b 636f 6e66 6967 7661 6c75 650c 2d00 ffff  |fig.configvalue.configvalue.-...|
       0x00e0 ffff fc90 0000 0000 3f00 0005 0364 6566 096e 6578 7463 6c6f 7564 0c6f 635f 6170  |........?....def.nextcloud.oc_ap|
       0x0100 7063 6f6e 6669 670c 6f63 5f61 7070 636f 6e66 6967 0474 7970 6504 7479 7065 0c3f  |pconfig.oc_appconfig.type.type.?|
       0x0120 000a 0000 0003 2100 0000 0005 0000 06fe 0000 0200 b302 0007 0463 6f72 650e 6669  |......!..................core.fi|
       0x0140 6c65 735f 6d65 7461 6461 7461 fc99 027b 2270 686f 746f 732d 6f72 6967 696e 616c  |les_metadata...{"photos-original|
       0x0160 5f64 6174 655f 7469 6d65 223a 7b22 7661 6c75 6522 3a6e 756c 6c2c 2274 7970 6522  |_date_time":{"value":null,"type"|
       0x0180 3a22 696e 7422 2c22 6574 6167 223a 2222 2c22 696e 6465 7865 6422 3a74 7275 652c  |:"int","etag":"","indexed":true,|
       0x01a0 2265 6469 7450 6572 6d69 7373 696f 6e22 3a30 7d2c 2270 686f 746f 732d 7369 7a65  |"editPermission":0},"photos-size|
       0x01c0 223a 7b22 7661 6c75 6522 3a6e 756c 6c2c 2274 7970 6522 3a22 6172 7261 7922 2c22  |":{"value":null,"type":"array","|
       0x01e0 6574 6167 223a 2222 2c22 696e 6465 7865 6422 3a66 616c 7365 2c22 6564 6974 5065  |etag":"","indexed":false,"editPe|
       0x0200 726d 6973 7369 6f6e 223a 307d 2c22 7068 6f74 6f73 2d65 7869 6622 3a7b 2276 616c  |rmission":0},"photos-exif":{"val|
       0x0220 7565 223a 6e75 6c6c 2c22 7479 7065 223a 2261 7272 6179 222c 2265 7461 6722 3a22  |ue":null,"type":"array","etag":"|
       0x0240 222c 2269 6e64 6578 6564 223a 6661 6c73 652c 2265 6469 7450 6572 6d69 7373 696f  |","indexed":false,"editPermissio|
       0x0260 6e22 3a30 7d2c 2270 686f 746f 732d 6966 6430 223a 7b22 7661 6c75 6522 3a6e 756c  |n":0},"photos-ifd0":{"value":nul|
       0x0280 6c2c 2274 7970 6522 3a22 6172 7261 7922 2c22 6574 6167 223a 2222 2c22 696e 6465  |l,"type":"array","etag":"","inde|
       0x02a0 7865 6422 3a66 616c 7365 2c22 6564 6974 5065 726d 6973 7369 6f6e 223a 307d 2c22  |xed":false,"editPermission":0},"|
       0x02c0 7068 6f74 6f73 2d67 7073 223a 7b22 7661 6c75 6522 3a6e 756c 6c2c 2274 7970 6522  |photos-gps":{"value":null,"type"|
       0x02e0 3a22 6172 7261 7922 2c22 6574 6167 223a 2222 2c22 696e 6465 7865 6422 3a66 616c  |:"array","etag":"","indexed":fal|
       0x0300 7365 2c22 6564 6974 5065 726d 6973 7369 6f6e 223a 307d 2c22 7068 6f74 6f73 2d70  |se,"editPermission":0},"photos-p|
       0x0320 6c61 6365 223a 7b22 7661 6c75 6522 3a6e 756c 6c2c 2274 7970 6522 3a22 7374 7269  |lace":{"value":null,"type":"stri|
       0x0340 6e67 222c 2265 7461 6722 3a22 222c 2269 6e64 6578 6564 223a 7472 7565 2c22 6564  |ng","etag":"","indexed":true,"ed|
       0x0360 6974 5065 726d 6973 7369 6f6e 223a 307d 2c22 626c 7572 6861 7368 223a 7b22 7661  |itPermission":0},"blurhash":{"va|
       0x0380 6c75 6522 3a6e 756c 6c2c 2274 7970 6522 3a22 7374 7269 6e67 222c 2265 7461 6722  |lue":null,"type":"string","etag"|
       0x03a0 3a22 3231 3066 6539 3564 3332 3037 3163 6136 6637 3566 6336 3432 3732 3365 6534  |:"210fe95d32071ca6f75fc642723ee4|
       0x03c0 6664 222c 2269 6e64 6578 6564 223a 6661 6c73 652c 2265 6469 7450 6572 6d69 7373  |fd","indexed":false,"editPermiss|
       0x03e0 696f 6e22 3a30 7d7d 0236 34e2 0000 0804 636f 7265 196f 632e 696e 7465 6772 6974  |ion":0}}.64.....core.oc.integrit|
       0x0400 7963 6865 636b 2e63 6865 636b 6572 bf7b 2263 6f72 6522 3a7b 2245 5854 5241 5f46  |ycheck.checker.{"core":{"EXTRA_F|
       0x0420 494c 4522 3a7b 2228 6e75 6c6c 2922 3a7b 2265 7870 6563 7465 6422 3a22 222c 2263  |ILE":{"(null)":{"expected":"","c|
       0x0440 7572 7265 6e74 223a 2230 3763 3439 3865 6131 6436 6435 3237 3464 3837 6662 6537  |urrent":"07c498ea1d6d5274d87fbe7|
       0x0460 3738 3339 3237 3734 6631 3134 3138 3465 6232 3831 6361 3564 6463 3934 6630 6435  |78392774f114184eb281ca5ddc94f0d5|
       0x0480 6339 3566 3364 6366 3934 3263 3639 6535 3133 3735 6631 6334 3032 3535 3835 6664  |c95f3dcf942c69e51375f1c4025585fd|
       0x04a0 6665 6565 3136 3763 3134 6230 3165 6436 6437 3032 6134 6565 3036 3537 3132 3036  |feee167c14b01ed6d702a4ee06571206|
       0x04c0 6331 3132 6330 3339 6122 7d7d 7d7d 0236 3405 0000 09fe 0000 0200                 |c112c039a"}}}}.64.........|

Note the EXTRA_FILE":{"(null)"…

This is the file name that will be created.

Next a shell will be forked that tries to invoke inkscape for some reason:

 38398 sh       NAMI  "/sbin/inkscape"
 38398 sh       RET   fstatat -1 errno 2 No such file or directory
 38398 sh       CALL  fstatat(AT_FDCWD,0xc2a7bc0b3b0,0x99effa4ec70,0)
 38398 sh       NAMI  "/bin/inkscape"
 38398 sh       RET   fstatat -1 errno 2 No such file or directory
 38398 sh       CALL  fstatat(AT_FDCWD,0xc2a7bc0b3b0,0x99effa4ec70,0)
 38398 sh       NAMI  "/usr/sbin/inkscape"
 38398 sh       RET   fstatat -1 errno 2 No such file or directory
 38398 sh       CALL  fstatat(AT_FDCWD,0xc2a7bc0b3b0,0x99effa4ec70,0)
 38398 sh       NAMI  "/usr/bin/inkscape"
 38398 sh       RET   fstatat -1 errno 2 No such file or directory
 38398 sh       CALL  fstatat(AT_FDCWD,0xc2a7bc0b3b0,0x99effa4ec70,0)
 38398 sh       NAMI  "/usr/local/sbin/inkscape"
 38398 sh       RET   fstatat -1 errno 2 No such file or directory
 38398 sh       CALL  fstatat(AT_FDCWD,0xc2a7bc0b3b0,0x99effa4ec70,0)
 38398 sh       NAMI  "/usr/local/bin/inkscape"
 38398 sh       RET   fstatat -1 errno 2 No such file or directory
 38398 sh       CALL  fstatat(AT_FDCWD,0xc2a7bc0b3b0,0x99effa4ec70,0)
 38398 sh       NAMI  "/root/bin/inkscape"
 38398 sh       RET   fstatat -1 errno 13 Permission denied
 38398 sh       CALL  openat(AT_FDCWD,0xc2a7bc0b3a8,0x601<O_WRONLY|O_CREAT|O_TRUNC>,0666<S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_I
WOTH>)
 38398 sh       NAMI  "(null)"
 38398 sh       RET   openat 3
 38398 sh       CALL  dup2(0x3,0x1)
 38398 sh       RET   dup2 1
 38398 sh       CALL  close(0x3)
 38398 sh       RET   close 0
 38398 sh       CALL  dup2(0x1,0x2)
 38398 sh       RET   dup2 2
 38398 sh       CALL  execve(0xc2a7bc0b408,0xc2a7bc0b260,0xc2a7bc0b3b0)
 38398 sh       NAMI  "/sbin/inkscape"
 38398 sh       RET   execve -1 errno 2 No such file or directory
 38398 sh       CALL  execve(0xc2a7bc0b408,0xc2a7bc0b260,0xc2a7bc0b3b0)
 38398 sh       NAMI  "/bin/inkscape"
 38398 sh       RET   execve -1 errno 2 No such file or directory
 38398 sh       CALL  execve(0xc2a7bc0b408,0xc2a7bc0b260,0xc2a7bc0b3b0)
 38398 sh       NAMI  "/usr/sbin/inkscape"
 38398 sh       RET   execve -1 errno 2 No such file or directory
 38398 sh       CALL  execve(0xc2a7bc0b408,0xc2a7bc0b260,0xc2a7bc0b3b0)
 38398 sh       NAMI  "/usr/bin/inkscape"
 38398 sh       RET   execve -1 errno 2 No such file or directory
 38398 sh       CALL  execve(0xc2a7bc0b408,0xc2a7bc0b260,0xc2a7bc0b3b0)
 38398 sh       NAMI  "/usr/local/sbin/inkscape"
 38398 sh       RET   execve -1 errno 2 No such file or directory
[...]

You can see the NAMI and the openat calls meaning the file will be created in the current working directory, probably the Nextcloud install root.

The shell itself is forked from a php-fpm process: 61933 php-fpm RET vfork 38398/0x95fe

Before that happens the PHP process does “something” with ImageMagick on an SVG file:

 61933 php-fpm  NAMI  "/usr/local/lib/ImageMagick-7.1.1//config-Q16HDRI/delegates.xml"
 61933 php-fpm  RET   openat -1 errno 2 No such file or directory
 61933 php-fpm  CALL  openat(AT_FDCWD,0x820cde3f0,0<O_RDONLY>)
 61933 php-fpm  NAMI  "/usr/local/etc/ImageMagick-7/delegates.xml"
 61933 php-fpm  RET   openat 7
 61933 php-fpm  CALL  lseek(0x7,0,SEEK_END)
 61933 php-fpm  RET   lseek 13238/0x33b6
 61933 php-fpm  CALL  mmap(0,0x33b6,0x1<PROT_READ>,0x2<MAP_PRIVATE>,0x7,0)
 61933 php-fpm  RET   mmap 37249720320/0x8ac41a000
 61933 php-fpm  CALL  munmap(0x8ac41a000,0x33b6)
 61933 php-fpm  RET   munmap 0
 61933 php-fpm  CALL  close(0x7)
 61933 php-fpm  RET   close 0
 61933 php-fpm  CALL  openat(AT_FDCWD,0x820cde3f0,0<O_RDONLY>)
 61933 php-fpm  NAMI  "/usr/local/share/doc/ImageMagick-7/delegates.xml"
 61933 php-fpm  RET   openat -1 errno 2 No such file or directory
 61933 php-fpm  CALL  openat(AT_FDCWD,0x820cde3f0,0<O_RDONLY>)
 61933 php-fpm  NAMI  "/var/www/.config/ImageMagick/delegates.xml"
 61933 php-fpm  RET   openat -1 errno 2 No such file or directory
 61933 php-fpm  CALL  getrandom(0x1bfdcea0a000,0x40,0)
 61933 php-fpm  RET   getrandom 64/0x40
 61933 php-fpm  CALL  getrandom(0x1bfdcea0a000,0x40,0)
 61933 php-fpm  RET   getrandom 64/0x40
 61933 php-fpm  CALL  fstatat(AT_FDCWD,0x1bfdd378c1f0,0x820cde2f8,0)
 61933 php-fpm  NAMI  "/tmp"
 61933 php-fpm  STRU  struct stat {dev=6952372408365240007, ino=34, mode=041777, nlink=9, uid=0, gid=0, rdev=0, atime=1761822900.854719000, mtime=1761823412.716995000, ctime=1761823412.716995000, birthtime=1680840389, size=9271, blksize=16384, blocks=4721, flags=0x800 }
 61933 php-fpm  RET   fstatat 0
 61933 php-fpm  CALL  getrandom(0x820cdddf0,0x28,0)
 61933 php-fpm  RET   getrandom 40/0x28
 61933 php-fpm  CALL  openat(AT_FDCWD,0x820ce25a0,0xa02<O_RDWR|O_CREAT|O_EXCL>,0600<S_IRUSR|S_IWUSR>)
 61933 php-fpm  NAMI  "/tmp/magick-UvdVnsoBrXG6FVRvKGBJzyiWGj6wrDUv"
 61933 php-fpm  RET   openat 7
 61933 php-fpm  CALL  fchmod(0x7,0600<S_IRUSR|S_IWUSR>)
 61933 php-fpm  RET   fchmod 0
 61933 php-fpm  CALL  close(0x7)
 61933 php-fpm  RET   close 0
 61933 php-fpm  CALL  unlink(0x1bfdd378d150)
 61933 php-fpm  NAMI  "/tmp/magick-UvdVnsoBrXG6FVRvKGBJzyiWGj6wrDUv"
 61933 php-fpm  RET   unlink 0
 61933 php-fpm  CALL  access(0x820cdd420,0<F_OK>)
 61933 php-fpm  NAMI  "/tmp/magick-UvdVnsoBrXG6FVRvKGBJzyiWGj6wrDUv.cache"
 61933 php-fpm  RET   access -1 errno 2 No such file or directory
 61933 php-fpm  CALL  __getcwd(0x820cde470,0x1000)
 61933 php-fpm  NAMI  "/var/www/nextcloud/releases/nextcloud-26.0.4/nextcloud"
 61933 php-fpm  RET   __getcwd 0
 61933 php-fpm  CALL  symlink(0x820cde470,0x820ce25a0)
 61933 php-fpm  NAMI  "/tmp/magick-UvdVnsoBrXG6FVRvKGBJzyiWGj6wrDUv"
 61933 php-fpm  RET   symlink 0
 61933 php-fpm  CALL  fstatat(AT_FDCWD,0x1bfdd378c1f0,0x820cdf338,0)
 61933 php-fpm  NAMI  "/tmp"
 61933 php-fpm  STRU  struct stat {dev=6952372408365240007, ino=34, mode=041777, nlink=9, uid=0, gid=0, rdev=0, atime=1761822900.854719000, mtime=1761823412.734993000, ctime=1761823412.734993000, birthtime=1680840389, size=9272, blksize=16384, blocks=4721, flags=0x800 }
 61933 php-fpm  RET   fstatat 0
 61933 php-fpm  CALL  openat(AT_FDCWD,0x820cdf5a0,0xa02<O_RDWR|O_CREAT|O_EXCL>,0600<S_IRUSR|S_IWUSR>)
 61933 php-fpm  NAMI  "/tmp/magick-h7yOIUftlU0SHMogT4kQTy2J-wySroIp"
 61933 php-fpm  RET   openat 7
 61933 php-fpm  CALL  fchmod(0x7,0600<S_IRUSR|S_IWUSR>)
 61933 php-fpm  RET   fchmod 0
 61933 php-fpm  CALL  close(0x7)
 61933 php-fpm  RET   close 0
 61933 php-fpm  CALL  unlink(0x1bfdd378d150)
 61933 php-fpm  NAMI  "/tmp/magick-h7yOIUftlU0SHMogT4kQTy2J-wySroIp"
 61933 php-fpm  RET   unlink 0
 61933 php-fpm  CALL  access(0x820cde470,0<F_OK>)
 61933 php-fpm  NAMI  "/tmp/magick-h7yOIUftlU0SHMogT4kQTy2J-wySroIp.cache"
 61933 php-fpm  RET   access -1 errno 2 No such file or directory
 61933 php-fpm  CALL  sigprocmask(SIG_BLOCK,0x820cdf340,0x820cdf370)
 61933 php-fpm  RET   sigprocmask 0
 61933 php-fpm  CALL  vfork
 61933 php-fpm  RET   vfork 38398/0x95fe

This delegates.xml tells ImageMagick to use inkscape for SVG it seems:

# grep inkscape /usr/local/etc/ImageMagick-7/delegates.xml
  <!-- Change export-filename to export-png for inkscape < 1.0 -->
  <delegate decode="svg:decode" stealth="True" command="&quot;inkscape&quot; &quot;%s&quot; --export-filename=&quot;%s&quot; --export-dpi=&quot;%s&quot; --export-background=&quot;%s&quot; --export-background-opacity=&quot;%s&quot; &gt; &quot;%s&quot; 2&gt;&amp;1"/>

Where to go from here?

install inkscape?
disable the function? how?
tell ImageMagick to use a particular scrap directory instead of the install root? how?

Thanks and kind regards,
Patrick

pmhausen · November 3, 2025, 7:30am

Does nobody know in which part of Nextcloud a database query result like this might be generated and which configuration issue might be the cause?

Kind regards,
Patrick

jtr · November 3, 2025, 6:01pm

The EXTRA_FILE is the integrity detection code. The files you’re referring to are going to show up there because they are, in fact, unexpected extra files. I don’t think that’s the source; but not surprised they end up shown there.

pmhausen · November 3, 2025, 9:44pm

So … any advice on how to track this down?