We have an existing script that runs under busybox's shell that uses exec to open a file with a specific file descriptor, then use that file descriptor in a call to flock to prevent concurrent instances from running. Something like:
exec 200> /var/run/applock
flock 200
The script works fine when run from the command line and cron, but when run from php system call from the web server, exec fails with error code 2, permission denied. I created a minimal example that reproduces the problem:
test.htm has the following php:
$res = 0;
system("/tmp/testing", $res);
print($res);
/tmp/testing script that is being called (also tested this scenario using sudo in the php system call, so in this script I logged the UID to verify it was root, but it also failed):
#!/bin/sh
logger $(id)
exec 200> /tmp/lock
logger Done
exit 0
The permissions on the files, full permissions for everybody:
(host:root) /tmp $ ls -la testing lock
-rwxrwxrwx 1 root root 0 Mar 26 13:38 lock
-rwxrwxrwx 1 root root 65 Mar 26 13:32 testing
The result in the web page is 2, and the following is logged in /var/log/messages (indicates that the script is actually being executed):
Mar 26 14:35:36 host user.notice www: uid=11(www) gid=11(www) groups=11(www)
We're using PHP 5.5.9, BusyBox 1.21.1, lighttpd 1.4.35 (using mod_fastcgi for php). In php.ini, safe mode is not enabled and we don't use disable_functions.
One interesting note is these files work when I run it from the command line as user www (same user as lighttpd is running):
/usr/local/bin/php-cgi -f test.htm
Just to be clear, we run a number of scripts from the web server in a similar fashion that work fine, and the script in question runs up until it hits the "exec 200> /var/run/applock". Any help would be appreciated.