Convert file to PDF using LibreOffice under user apache (i.e. when using PHP)

Question

I installed libreoffice-headless and can convert documents when logged on into the shell as a normal user.

[root@desktop ~]# yum install libreoffice-headless
[root@desktop ~]# yum install libreoffice-writer
[root@desktop ~]# su NotionCommotion
sh-4.1$ /usr/bin/libreoffice --headless -convert-to pdf --outdir /tmp/ayb /tmp/ayb/document_34.doc
convert /tmp/ayb/document_34.doc -> /tmp/ayb/document_34.pdf using writer_pdf_Export

I now wish to do the same thing, but using PHP and therefore as user apache, however, the following will not convert the file.

<?php
  shell_exec('/usr/bin/libreoffice --headless -convert-to pdf --outdir /tmp/ayb /tmp/ayb/document_34.doc');
?>

In an attempt to troubleshoot, I ran the same command through the shell as user apache, but still it will not convert the file:

[root@desktop ~]# su -s /bin/sh apache -c "/usr/bin/libreoffice --headless -convert-to pdf --outdir /tmp/ayb /tmp/ayb/document_34.doc"

Apache unlike normal users doesn't have a home, and I recall hearing I might need to specify a home using HOME=/tmp/ayb before attempting to convert, but it doesn't help (I think when using CentOS 5.8 and probably a different version of LibreOffice, it did, but am not certain).

How do I convert a file to PDF using libreoffice when running it as user apache?

Installed System:

CentOS 6.4
httpd.x86_64                    2.2.15-28.el6.centos              @updates
libreoffice-headless.x86_64     1:3.4.5.2-16.1.el6_3              @base

Solution 1

There are two problems here. The first is that www-data (the apache user) does not have a $HOME so libreoffice cannot run if there is no $HOME defined. The second problem is, unless you specifically set it up this way (and you really really really shouldn't), apache does not have access to the system /tmp directory. A web server normally runs in a restricted environment and does not have full access to the file system for very valid security reasons.

So, you need to i) give apache's user a home and ii) give it a directory it has access to to write in. So, create a tmp directory in the same folder where you store your webpage and then run the following php code:

<?php
  shell_exec('export HOME=/tmp && libreoffice --headless -convert-to pdf --outdir ./tmp /tmp/ayb/document_34.doc');
?>

I just tested and it works perfectly on my machine. Make sure your ./tmp has its permissions set to 777. Also, you may need to restart apache if you play aroud with it too much. It stopped working for me after a while when I made changes and I needed to restart it.

Solution 2

I had similar problem on Debian and I solved it.

Run your command, but with strace on the beginning, like this:
strace -f -o output.txt soffice --headless --convert-to pdf (...)

This will produce huge log file with every access to the system API and its result.
In my case, somewhere near line 5000 there was something like this:
open("/var/spool/libreoffice/uno_packages/cache/uno_packages", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)

Following this trail, I changed permissions recursively for folder /var/spool/libreoffice to 777.

After that, conversion started to work for every user.

Maybe you also get Permission denied on some other file, it is handled silently, and you need to fix permissions for your user?

Comments

[user1032531]

Thanks terdon, works perfect for me as well. Couple of questions. Why not keep them in /tmp, and not in the same folder as where webpages are stored (I tested it, it works). Why doesn't export HOME=/tmp/ayb libreoffice --headless ... work? What is the purpose of export and why doesn't HOME=/tmp/ayb; libreoffice --headless.... work?

[terdon]

If you can actually write to /tmp you are free to do so. However, it is a good idea from a security point of vew to not give your web server access to directories that are outside /var/www. export exports the variable, making it available to all subsequent shells and && makes sure it runs only if the export was successful. I'm not sure about the details, apache can be quite finicky about permissions, it is always better to keep everything under your www folder.

[user1032531]

I am mixed on using tmp. Yes, apache can write to /tmp, and a good thing (I think) about using it is that it automatically purges old files. But then again, I see your point about keeping everything under /var/www.

[Stanislav Ivanov]

Also actual for Ubuntu (without home directory libreoffice --headless dies after X11 connection rejected because of wrong authentication message).