Why php can not see /tmp files

filesPHPsandboxsystemdtmp

i have simple test.php page: 

<pre><?php system("ls -la /tmp"); ?></pre>

which always shows just: . and .. folders and nothing else in browser.

in the command line:

1) ls -la /tmp
2) sudo -u http ls -la /tmp
3) php test.php
4) sudo -u http php test.php

all this commands returns full list of directory files/subdirs.

What is the reason for this???

And problem is "/tmp" folder related because ls -lah /usr works OK.

i tested this on 4 comps (one of them was debian with php 5.0.6 and there php shows all files OK like i expected, other 3 comps has php7 and shows empty /tmp).

update:

even after adding http to sudoers file and running 'sudo ls /tmp', problem is the same on php versions >7.

but runing 'system("echo aaa > /tmp/aaa.txt; ls -la /tmp") shows . , .. , and aaa.txt file owned by http:http. So is this some new php restriction and how it is posible to interfere on /tmp files only.

update2:

but aaa.txt is not inside /tmp, and by running find /tmp -name aaa.txt, i see that it is inside /tmp/systemd-private-2cf1853410ad4ade980ec17e883771c3-httpd.service-lZ22gS/tmp/aaa.txt .

so finaly it is related to something called "systemd /tmp isolation"… that i need to learn about.

Changing true to false inside: /etc/systemd/system/multi-user.target.wants/httpd.service:

[Service]
PrivateTmp=false
...

solves my problem, but i am wondering is it possible to avoid this without changing service file.

Best Answer

I am running Ubuntu 18.04 and /usr/lib/systemd did not contain any services for http or apache2. However, I executed the following command:

sudo find / -mount -type f -exec grep -e "PrivateTmp" '{}' ';' -print

and found in /lib/systemd/apache2.service the PrivateTmp=true. Changing true to false and executing

systemctl daemon-restart
systemctl restart apache2

fixed the problem.

Related Question