3 ms·

Maybe Off-topic, not sure if systemd is to blame or Apache or the package maintainers , but on a LAMP stack i was creating some images in the temp folder then d

Maybe Off-topic, not sure if systemd is to blame or Apache or the package maintainers , but on a LAMP stack i was creating some images in the temp folder then do some work on them. So for debugging I wanted to opent he temp folder and look at the images. The files were not there, the system is now full of magic, it pretends it gives you a temp file like /tmp/file1.png but the file is not there. I fcking Have o idea why they think is a good idea to lie to me what the file path is, I had luck that some other person hit this issue and somehow google managed to put it as a result to my searches.

5- 4y ago
that sounds like my good old enemy https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html https://www.freedesktop.org/software/systemd/man/tmpfiles.d....
ciupicri 4y ago
It's because Apache httpd or other services are probably using their own "version"/"instance" of /tmp for better isolation from the rest of the system and extra security. From the point of view of the program the files are written under /tmp, but in reality they're stored somewhere else. Try this to see the files: ls /tmp/systemd-private-$(systemd-id128 boot-id)-httpd.service-*/tmp Run systemctl show --all httpd.service and look out for the PrivateTmp directive [1]. Use systemctl edit httpd.service to override it. [1]: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#PrivateTmp= https://www.freedesktop.org/software/systemd/man/systemd.exe...
- simion314 4y ago
  Thanks. But this is such a antiuser feature, like the incident was like 1 I use std function to get a temp file path 2 I write content in that file 3 I do all the checks to ensure the write worked, I use std functions to check file exists 4 I use std function to print the file path And the file path is a lie, It all would be fine if it would use the real path, and if a newb would hardocde "/tmp/file1" then I would be happy with a error message that I can't write there . I assume they had some reasons for the lie, I am not convinced it was worth it, I do not like magic hidden stuff.
  - ciupicri 4y ago
    I've been bitten by this, so I know the feeling. Once you know what's going on, it's not magic anymore :-) The "antifeature" can be disabled if you don't like it, but keep in mind that it increases security. There have been vulnerabilities related to temporary files [1][2]. Usually there is no need for a web server running in production to make its temporary files accessible to the rest of the world. The "lie" is similar to what happens when you're using virtual machines. The virtual machine thinks it's using some hardware, but in reality... On a side note, Flatpak also does this by default sometimes. It can run applications in a sandbox in which even the home directory is partially inaccessible. [1]: https://cwe.mitre.org/data/definitions/377.html https://cwe.mitre.org/data/definitions/377.html [2]: https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cwe_id=CWE-377&isCpeNameSearch=false https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...
- ciupicri 4y ago
  P.S. When you're editing the service, write this in the drop-in: [Service] PrivateTmp=no

5- 4y ago

that sounds like my good old enemy https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html https://www.freedesktop.org/software/systemd/man/tmpfiles.d....

ciupicri 4y ago

It's because Apache httpd or other services are probably using their own "version"/"instance" of /tmp for better isolation from the rest of the system and extra security. From the point of view of the program the files are written under /tmp, but in reality they're stored somewhere else. Try this to see the files: ls /tmp/systemd-private-$(systemd-id128 boot-id)-httpd.service-*/tmp Run systemctl show --all httpd.service and look out for the PrivateTmp directive [1]. Use systemctl edit httpd.service to override it. [1]: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#PrivateTmp= https://www.freedesktop.org/software/systemd/man/systemd.exe...

simion314 4y ago
Thanks. But this is such a antiuser feature, like the incident was like 1 I use std function to get a temp file path 2 I write content in that file 3 I do all the checks to ensure the write worked, I use std functions to check file exists 4 I use std function to print the file path And the file path is a lie, It all would be fine if it would use the real path, and if a newb would hardocde "/tmp/file1" then I would be happy with a error message that I can't write there . I assume they had some reasons for the lie, I am not convinced it was worth it, I do not like magic hidden stuff.
- ciupicri 4y ago
  I've been bitten by this, so I know the feeling. Once you know what's going on, it's not magic anymore :-) The "antifeature" can be disabled if you don't like it, but keep in mind that it increases security. There have been vulnerabilities related to temporary files [1][2]. Usually there is no need for a web server running in production to make its temporary files accessible to the rest of the world. The "lie" is similar to what happens when you're using virtual machines. The virtual machine thinks it's using some hardware, but in reality... On a side note, Flatpak also does this by default sometimes. It can run applications in a sandbox in which even the home directory is partially inaccessible. [1]: https://cwe.mitre.org/data/definitions/377.html https://cwe.mitre.org/data/definitions/377.html [2]: https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cwe_id=CWE-377&isCpeNameSearch=false https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...
ciupicri 4y ago
P.S. When you're editing the service, write this in the drop-in: [Service] PrivateTmp=no