Problems with PHP 5.3 and Session Folders

Question

I recently upgraded to PHP 5.3, and since then I receive (sporadic) error messages that indicate that Apache (or maybe cleaner session files) does not have rights to the folder in which the sessions are stored.
This happens randomly and cannot be reproduced in exact steps, which led me to speculate that this is a session cleaner.
Does anyone have experience with such errors?

Error message (which runs in session_start() ):

ps_files_cleanup_dir: opendir (/ var / lib / php5) failed: Permission denied.

ls -ltr in the session directory gives:

 drwx-wx-wt 2 root root 4096 2010-05-25 12:39 php5 

Inside this directory, I see session files belonging to www-data, which is my Apache, and the application is working fine. What makes me wonder what user is running a GC session under?

Answer 1

Fix: In your php.ini set session.gc_probability to 0

Reason I believe I found the answer here http://somethingemporium.com/2007/06/obscure-error-with-php5-on-debian-ubuntu-session-phpini-garbage

Essentially, garbage collection is configured to work cron on some systems (e.g. Ubuntu / Debian). Some php ini executables, such as php-cli, also try to do garbage collection, and this leads to the error you received.

Answer 2

This is a typical error on Ubuntu servers (I use Lucid LTS). There are default permissions for the directory / var / lib / php 5

 drwx-wx-wt 2 root root 4096 2011-11-04 02:09 php5 

therefore it can be written, but not read by the web server, I think this explains the errors.

Since Ubuntu has its own garbage collection via cron ( /etc/cron.d/php5 ), it is probably best to disable php garbage collection, as suggested by Diwant Vaidya above.

 session.gc_probability = 0 

Actually the reason that the session folder should not be read in the world is because the PHP Manual says:

If you leave this set in a global directory, for example / tmp (by default), other users on the server can arrange sessions to obtain a list of files in this directory.

Answer 3

The solution I'm currently using (which I'm not sure is the right one) is to provide the copyright holder in the session folder with the Apache user (www-data in my case).

Answer 4

This problem has been listening to me for a while. I changed the value as suggested in php.ini and the problem continued. I found the same configuration value in my index.php as well as private / Zend / session.php. Therefore, it is worth looking a little deeper if the problem persists. Hope this is useful to someone.