SplFileInfo::openFile(/app/tmp/cache/persistent/cake_core_cake_console_):failed to open stream:Permission denied in /lib/.../FileEngine.php line 293

Question

I am working on a CakePHP 2 project. It originally started out in 2.0.x and then recently migrated to 2.1.0. Throughout the whole development process, I have been receiving the error message below.

It pops up at the top of the page unpredictably. It can be when I am just viewing different pages, or even after I add a record to the database (yet the record properly saves).

Warning:
SplFileInfo::openFile(/var/www/cake_prj/app/tmp/cache/persistent/cake_core_cake_console_): 
failed to open stream: 
Permission denied in 
     /var/www/cake_prj/lib/Cake/Cache/Engine/FileEngine.php on line 293

I recursively set the owner and group of the tmp folder to apache, and still received the message. In addition, I then recursively set the permissions to read, write, and execute for all (chmod 777). The error message still pops up.

Even after changing both the owner, group, and permissions, the file in question:

cake_prj/app/tmp/cache/persistent/cake_core_cake_console_

will have its owner and group set back to root, and its permissions set back to default.

What could be causing this problem? Is there a way to ensure that every time this file is generated, that it will always have be apache:apache with read/write/execute permissions?

Solution 1

There was a bug report there http://cakephp.lighthouseapp.com/projects/42648/tickets/2172 but it was considered as not being a bug.

What I personaly noticed is that some file owner may be modified when you use the cake script in the console (for instance to make a bake). The modified files then belong to the user you use in the console.

Would this mean you call cake while being root ? Or do you have any root cron job that calls a Cake shell script ?

Personaly I have now the habit to chmod the whole tmp folder content back to the apache user after having used the cake script and it seems to prevent the warning to appear.

Solution 2

You can resolve this by adding a mask to your config in core.php

Cache::config('default', array(
    'engine' => 'File',
    'mask' => 0666,
));

Solution 3

Instead of setting giving read/write access to everyone on the tmp/cache directory I did this:

chgrp -R www-data app/tmp
chmod -R g+rw app/tmp 
find app/tmp -type d -exec chmod g+s {} \;

Setting the group of the directories to the Apache user and then setting the setgid bit will allow you to ensure that files created in that directory get the proper group permissions regardless of what user runs the shell script. This also allows you to exclude read/write permissions to "other" users.

Solution 4

I think the reason of the problem is already explained, as the cron runs under root user and created files in tmp are not accessible by web user. The other solutions did not work for me and I did not want to set tmp permissions to 777, I ended up setting a cron job for the web user, in debian specifically it would be

crontab -u www-data -e

Taken from this answer How to specify in crontab by what user to run script?

View more solutions

Comments

[penguin egg]

nIcO, thanks for the response. I do call cake while logged in as root. Although I set my whole tmp folder to have its owner and group as apache:apache, and then chmod 777 the whole folder recursively. And then I ran cake bake but afterwards, the permissions were still correctly set. So the cake script doesn't seem to be causing it.

[nIcO]

I'm not sure it regenerates files everytime you use the cake script. So it may not always recreate files belonging to root even if this is the user you use. By the way, you should probably better not use root to call cake.

[penguin egg]

Hasn't happened recently and I haven't ran cake recently so I am wondering if that was the problem. I will keep following this and see if it happens again.

[penguin egg]

Do you think you could explain to me what this does?

[penguin egg]

Just an update. After going a long time without seeing the error message, I recently baked some files again and it started appearing again. So I believe your solution is correct, but I will wait until I understand more about the other solution.

[penguin egg]

It may have changed servers a few times but I believe the server it ran on always had the minimum PHP requirements (currently the server has 5.3.3). One thing to note though is that it only seems to happen when I run a version of the app on a virtual machine. I'm not sure if that indicates anything else?

[BeesonBison]

I've just run into the same issue and this seemed to fix it for me. As Mark Story explains: "Sounds like permissions issues. This can happen when your cli and apache users are different, or your umask is not permissive enough." The workaround seems to be to use the 'mask' option as described above and here cakephp.lighthouseapp.com/projects/42648/tickets/2172

[joshua.paling]

I think this should go in bootstrap.php not core.php

[Code Commander]

This seems like a pretty big security hole if you make your cache readable and writable by everyone.