php.ini INI_SYSTEM: local value of "sys_temp_dir" does not overide master value and can bypass "open_basedir" (not a security issue FMPOV)

Description

Hello!

I really hope this "issue" is not a duplicate: found nothing specific about this behavior in open/closed issues or mailing list archives.

Long story short: parameter "sys_temp_dir" does not seem to work as intended when overridden in a specific vhost.

• Linux VPS - Debian 12 (bookworm) - 32 vCore - 32 Go RAM - 4 Go SWAP

• PHP versions tested: 7.4.33, 8.0.30, 8.1.27, 8.2.17 and 8.3.4

• Opcache:
  opcache.error_log = /var/log/php8.3/opcache.log
opcache.log_verbosity_level = 2
opcache.max_accelerated_files = 16229
opcache.max_file_size = 4194304
opcache.max_wasted_percentage = 1
opcache.memory_consumption = 320
opcache.revalidate_freq = 0

• /etc/php/8.3/fpm/php.ini
  doc_root = /var/jail/deny/
open_basedir = /var/jail/deny/
sys_temp_dir = /var/jail/allow/

• /var/jail/
  drwxr-xr-x 5 root root 4096 2024-04-03 21:14 ./
drwxr-xr-x 13 root root 4096 2024-03-04 14:38 ../
drwx------ 2 root root 4096 2024-04-03 20:48 deny/
drwx------ 2 www-vhost root 4096 2024-04-03 21:16 allow/

• /etc/php/8.3/fpm/conf.d/99-vhosts.ini
  [PATH=/vhosts/www.website.tld]
doc_root = /vhosts/www.website.tld/html/
open_basedir = /vhosts/www.website.tld/
sys_temp_dir = /vhosts/www.website.tld/var/tmp/

• /vhosts/www.website.tld/var/
  drwxr-x--- 6 root www-vhost 4096 2021-09-15 23:16 ./
drwxr-x--- 7 root www-vhost 4096 2024-03-02 00:52 ../
drwxr-x--- 2 www-vhost www-vhost 4096 2024-04-03 20:35 tmp/

• phpinfo:
  Directive Local Value Master Value
doc_root /vhosts/www.website.tld/html/ /var/jail/deny/
open_basedir /vhosts/www.website.tld/ /var/jail/deny/
sys_temp_dir /vhosts/www.website.tld/var/tmp/ /var/jail/allow/

So far so good... ^^

But, what really happens, is that some temporary files are still created/written in "/var/jail/allow/" directory:

# inotifywait -m -r /var/jail/
Setting up watches. Beware: since -r was given, this may take a while!
Watches established.
/var/jail/allow/ CREATE phpoWnujz
/var/jail/allow/ OPEN phpoWnujz
/var/jail/allow/ MODIFY phpoWnujz
/var/jail/allow/ MODIFY phpoWnujz
/var/jail/allow/ ACCESS phpoWnujz
/var/jail/allow/ CLOSE_WRITE,CLOSE phpoWnujz
/var/jail/allow/ DELETE phpoWnujz

Please note that path "/var/jail/allow/" is outside "open_basedir" directory and PHP does not yield any warning or error.

Also, if "sys_temp_dir" master value is set to a path not readable/writable by PHP ("www-vhost" in this case), temporary files are not created at all, even if phpinfo() says that "/vhosts/www.website.tld/var/tmp/" is used.

If you need more infos, please ask!

Have a great day and many, many thanks for PHP. :)

PHP Version

PHP 7.4.33 PHP 8.0.30 PHP 8.1.27 PHP 8.2.17 PHP 8.3.4

Operating System

Debian 12 (bookworm)

Bắt đầu bằng cách tái hiện hành vi với các thiết lập php.ini và 99-vhosts.ini dành riêng cho vhost được liệt kê, sau đó theo dõi /var/jail/ bằng inotifywait và so sánh các giá trị của phpinfo(). Truy vết cách các ghi đè sys_temp_dir và việc tạo tệp tạm thời tương tác với open_basedir; công việc được xem là hoàn tất khi hành vi đã được giải thích và được bao phủ bằng một kiểm thử hồi quy trên các đường dẫn cấu hình đã được báo cáo.