Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug]: Error changing tempdirectory #49185

Closed
5 of 8 tasks
jmalbarran opened this issue Nov 10, 2024 · 2 comments · May be fixed by nextcloud/documentation#12383
Closed
5 of 8 tasks

[Bug]: Error changing tempdirectory #49185

jmalbarran opened this issue Nov 10, 2024 · 2 comments · May be fixed by nextcloud/documentation#12383
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap 30-feedback bug needs info

Comments

@jmalbarran
Copy link

⚠️ This issue respects the following points: ⚠️

Bug description

I'm trying to change the tempdirectory to a new one location.
I have checked the bug database, and seen that in the past this created issues, but I'm not able to solve:

In the config/config.php I have:

'tempdirectory' => "/test/tmp",

In the /etc/php.ini I have:

open_basedir = /documents/Nextcloud:/tmp:/test/tmp:/dev/urandom
sys_temp_dir = "/test/tmp"
upload_temp_dir = "/test/tmp"

In the /etc/php-fpm.d/www.conf

env[TMP] = /test/tmp

But with this configuration, I get the error in nextcloud.log

{"reqId":"ZzBuoCRaB40CEOWH-GgG8gAAABA","level":2,"time":"2024-11-10T08:28:16+00:00","remoteAddr":"192.168.10.100","user":"admin","app":"no app in context","method":"GET","url":"/nextcloud/ocs/v2.php/apps/notifications/api/v2/notifications","message":"Temporary directory /test/tmp is not present or writable","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","version":"30.0.2.2","data":[]}

Steps to reproduce

  1. Create a new folder /test/tmp
  2. Change owner to apache:apache and chmod 777
  3. Configure nextcloud and php

In the config/config.php I have:

'tempdirectory' => "/test/tmp",

In the /etc/php.ini I have:

open_basedir = /documents/Nextcloud:/tmp:/test/tmp:/dev/urandom
sys_temp_dir = "/test/tmp"
upload_temp_dir = "/test/tmp"

In the /etc/php-fpm.d/www.conf

env[TMP] = /test/tmp

Directory grants

ls -la /test/tmp
total 0
drwxrwxrwx. 2 apache     apache  18 nov 10 08:58 .
drwxr-xr-x. 4 jmalbarran wheel  135 nov  8 20:23 ..

ls -Z /test/tmp
unconfined_u:object_r:public_content_rw_t:s0 pepe

No error in SELinux logs

Expected behavior

No error in log

Nextcloud Server version

30

Operating system

RHEL/CentOS

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "***REMOVED LOCAL DOMAIN NAME***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "tempdirectory": "\/test\/tmp",
        "dbtype": "mysql",
        "version": "30.0.2.2",
        "overwrite.cli.url": "http:\/\/localhost",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "maintenance_window_start": 1,
        "default_phone_region": "ES",
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtptimeout": 30,
        "mail_sendmailmode": "smtp",
        "mail_smtpport": "465",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl"
    }
}

List of activated Apps

Enabled:
  - activity: 3.0.0
  - app_api: 4.0.0
  - bruteforcesettings: 3.0.0
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contactsinteraction: 1.11.0
  - dashboard: 7.10.0
  - dav: 1.31.1
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - firstrunwizard: 3.0.0
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - nextcloud_announcements: 2.0.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - photos: 3.0.2
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - text: 4.1.0
  - theming: 2.5.0
  - twofactor_backupcodes: 1.19.0
  - updatenotification: 1.20.0
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - admin_audit: 1.20.0
  - encryption: 2.18.0
  - files_external: 1.22.0
  - suspicious_login: 8.0.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"ZzBuoCRaB40CEOWH-GgG8gAAABA","level":2,"time":"2024-11-10T08:28:16+00:00","remoteAddr":"192.168.10.100","user":"admin","app":"no app in context","method":"GET","url":"/nextcloud/ocs/v2.php/apps/notifications/api/v2/notifications","message":"Temporary directory /test/tmp is not present or writable","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","version":"30.0.2.2","data":[]}

Additional info

No response
@jmalbarran jmalbarran added 0. Needs triage Pending check for reproducibility or if it fits our roadmap bug labels Nov 10, 2024
@joshtrichards
Copy link
Member

This sounds like a config matter with SELinux. Note not everything is logged by default, particularly system calls used to probe for access:

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-troubleshooting-fixing_problems#sect-Security-Enhanced_Linux-Fixing_Problems-Possible_Causes_of_Silent_Denials

@jmalbarran
Copy link
Author

Thank you very much!!!

The sudo semodule -SB (from your the link) did the trick for diagnose.

And sudo setsebool -P httpd_anon_write 1solved the issue

@joshtrichards joshtrichards mentioned this issue Nov 19, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap 30-feedback bug needs info
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

docs(admin): Add tip about detecting silent denials in SELinux nextcloud/documentation
3 participants
@joshtrichards @szaimen @jmalbarran