php.ini INI_SYSTEM: local value of "sys_temp_dir" does not overide master value and can bypass "open_basedir" (not a security issue FMPOV)

Description

Hello!

I really hope this "issue" is not a duplicate: found nothing specific about this behavior in open/closed issues or mailing list archives.

Long story short: parameter "sys_temp_dir" does not seem to work as intended when overridden in a specific vhost.

• Linux VPS - Debian 12 (bookworm) - 32 vCore - 32 Go RAM - 4 Go SWAP

• PHP versions tested: 7.4.33, 8.0.30, 8.1.27, 8.2.17 and 8.3.4

• Opcache:
  opcache.error_log = /var/log/php8.3/opcache.log
opcache.log_verbosity_level = 2
opcache.max_accelerated_files = 16229
opcache.max_file_size = 4194304
opcache.max_wasted_percentage = 1
opcache.memory_consumption = 320
opcache.revalidate_freq = 0

• /etc/php/8.3/fpm/php.ini
  doc_root = /var/jail/deny/
open_basedir = /var/jail/deny/
sys_temp_dir = /var/jail/allow/

• /var/jail/
  drwxr-xr-x 5 root root 4096 2024-04-03 21:14 ./
drwxr-xr-x 13 root root 4096 2024-03-04 14:38 ../
drwx------ 2 root root 4096 2024-04-03 20:48 deny/
drwx------ 2 www-vhost root 4096 2024-04-03 21:16 allow/

• /etc/php/8.3/fpm/conf.d/99-vhosts.ini
  [PATH=/vhosts/www.website.tld]
doc_root = /vhosts/www.website.tld/html/
open_basedir = /vhosts/www.website.tld/
sys_temp_dir = /vhosts/www.website.tld/var/tmp/

• /vhosts/www.website.tld/var/
  drwxr-x--- 6 root www-vhost 4096 2021-09-15 23:16 ./
drwxr-x--- 7 root www-vhost 4096 2024-03-02 00:52 ../
drwxr-x--- 2 www-vhost www-vhost 4096 2024-04-03 20:35 tmp/

• phpinfo:
  Directive Local Value Master Value
doc_root /vhosts/www.website.tld/html/ /var/jail/deny/
open_basedir /vhosts/www.website.tld/ /var/jail/deny/
sys_temp_dir /vhosts/www.website.tld/var/tmp/ /var/jail/allow/

So far so good... ^^

But, what really happens, is that some temporary files are still created/written in "/var/jail/allow/" directory:

# inotifywait -m -r /var/jail/
Setting up watches. Beware: since -r was given, this may take a while!
Watches established.
/var/jail/allow/ CREATE phpoWnujz
/var/jail/allow/ OPEN phpoWnujz
/var/jail/allow/ MODIFY phpoWnujz
/var/jail/allow/ MODIFY phpoWnujz
/var/jail/allow/ ACCESS phpoWnujz
/var/jail/allow/ CLOSE_WRITE,CLOSE phpoWnujz
/var/jail/allow/ DELETE phpoWnujz

Please note that path "/var/jail/allow/" is outside "open_basedir" directory and PHP does not yield any warning or error.

Also, if "sys_temp_dir" master value is set to a path not readable/writable by PHP ("www-vhost" in this case), temporary files are not created at all, even if phpinfo() says that "/vhosts/www.website.tld/var/tmp/" is used.

If you need more infos, please ask!

Have a great day and many, many thanks for PHP. :)

PHP Version

PHP 7.4.33 PHP 8.0.30 PHP 8.1.27 PHP 8.2.17 PHP 8.3.4

Operating System

Debian 12 (bookworm)

Start by reproducing the behavior with the listed php.ini and vhost-specific 99-vhosts.ini settings, then observe /var/jail/ with inotifywait and compare phpinfo() values. Trace how sys_temp_dir overrides and temporary-file creation interact with open_basedir; done means the behavior is explained and covered by a regression test across the reported configuration paths.