chrooting php-fpm with nginx
- by dragonmantank
I'm setting up a new server with PHP 5.3.9 and nginx, so I compiled PHP with the php-fpm SAPI options. By itself it works great using the following server entry in nginx:
server {
listen 80;
server_name domain.com www.domain.com;
root /var/www/clients/domain.com/www/public;
index index.php;
log_format gzip '$remote_addr - $remote_user [$time_local] "$request" $status $bytes_sent "$http_referer" "$http_user_agent" "$gzip_ratio"';
access_log /var/www/clients/domain.com/logs/www-access.log;
error_log /var/www/clients/domain.com/logs/www-error.log error;
location ~\.php$ {
fastcgi_pass 127.0.0.1:9001;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /var/www/clients/domain.com/www/public$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_script_name;
include /etc/nginx/fastcgi_params;
}
}
It servers my PHP files just fine. For added security I wanted to chroot my FPM instance, so I added the following lines to my conf file for this FPM instance:
# FPM config
chroot = /var/www/clients/domain.com
and changed the nginx config:
#nginx config for chroot
location ~\.php$ {
fastcgi_pass 127.0.0.1:9001;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME www/public$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_script_name;
include /etc/nginx/fastcgi_params;
}
With those changes, nginx gives me a File not found message for any PHP scripts. Looking in the error log I can see that it's prepending the root path to my DOCUMENT_ROOT variable that's passed to fastcgi, so I tried to override it in the location block like this:
fastcgi_param DOCUMENT_ROOT /www/public/;
fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
but I still get the same error, and the debug log shows the full, unchrooted path being sent to PHP-FPM.
What am I missing to get this to work?
