No write access to /tmp

[Lars Kusch]

Hi there,
I'm running a regular Ubuntu 22.04 Server with DirectAdmin and Litespeed.
My customer is running a software which calls:

exec '/home/admin/domains/blumagine.de/rechnung/vendor/beganovich/snappdf/versions/1105642-Linux_x64/chrome-linux/chrome' '--headless' '--disable-gpu' '--disable-translate' '--disable-extensions' '--disable-sync' '--disable-background-networking' '--disable-software-rasterizer' '--disable-default-apps' '--disable-dev-shm-usage' '--safebrowsing-disable-auto-update' '--run-all-compositor-stages-before-draw' '--no-first-run' '--no-margins' '--no-sandbox' '--print-to-pdf-no-header' '--hide-scrollbars' '--ignore-certificate-errors' '--print-to-pdf=/tmp/pdf_EW2WaF.pdf' '/tmp/html_PYT0Em.html'

, which fails with no write access to /tmp and chrashes the server. As soon as the command is called without the exec statement, it's working perfectly fine.

Does anybody have an idea for this weird issue?

Kind regards,
Lars Kusch

 

[zEitEr]

Hello,

While it's not clear on why writing to /tmp fails, will it help if you change it to /home/admin/ ?

 

[Lars Kusch]

Hi,
the script, which is running is the following: https://github.com/beganovich/snapp...535cd13a704e27caaf5a7570/src/Snappdf.php#L257
The issue happens to any path, as long as the exec is there. I can choose nearly any path for the pdf-file, when I directly execute the chrome binary, without exec before.

 

[zEitEr]

Then it is probably related to a security of the system. Not too sure though.

What if you run your command from CLI ? I mean add your code into a php script and run it from console? Will it work?

Create script.php and add your code into it:

<?php
exec(.....);

and then php -f script.php?

 

[Lars Kusch]

Hi,
thanks for your help. When the command is executed from php is just runs fine. No issues, all is well

 

[zEitEr]

Do you run the CLI script.php as the same user or root? What if you run the same script.php from a browser?

 

[Lars Kusch]

When running from cli, I was admin, which is the same as the application is. From the webbrowser it fails

 

[zEitEr]

Probably open basedir restriction is in an effect?