Config sync directory outside of webroot causes open_basedir restriction warning

Question

Hello all and thank you for taking the time to help. In following this tutorial and many others like it, I've successfully moved the configuration sync directory outside of my webroot, both locally and on production. I can confirm that it's working using drush cex and drush cim in both locations.

Hopefully Helpful Info

• Drupal 8.3.5
• On production, I have the config directory set with 775 permissions (and export/import still worked with 755).
• in settings.php, I have $config_directories[CONFIG_SYNC_DIRECTORY] = '../config/sync'
• since it couldn't be created by Drupal, I created a .htaccess file for this directory on my own.
• config is being version controlled, but due to how/where Drupal was installed, I'm having to maintain a separate git repo for this single directory, which doesn't bother me. Drush still seems to work with no complaints.

The Problem

Within the UI, I get the following status report errors:

• Warning: is_writable(): open_basedir restriction in effect. File(../config/sync) is not within the allowed path(s): (/home/cathchar/www:/tmp) in config_requirements() (line 24 of core/modules/config/config.install).
• Warning: file_exists(): open_basedir restriction in effect. File(../config/sync/.htaccess) is not within the allowed path(s): (/home/cathchar/www:/tmp) in file_save_htaccess() (line 367 of core/includes/file.inc).
• Warning: file_exists(): open_basedir restriction in effect. File(../config/sync) is not within the allowed path(s): (/home/cathchar/www:/tmp) in file_save_htaccess() (line 374 of core/includes/file.inc).
• Warning: is_dir(): open_basedir restriction in effect. File(../config/sync) is not within the allowed path(s): (/home/cathchar/www:/tmp) in system_requirements() (line 600 of core/modules/system/system.install).
• Warning: is_dir(): open_basedir restriction in effect. File(../config/sync) is not within the allowed path(s): (/home/cathchar/www:/tmp) in system_requirements() (line 603 of core/modules/system/system.install).
• (and below these) CONFIGURATION DIRECTORY: SYNC - The directory ../config/sync does not exist.

What I do/don't understand

I'm swimming in deeper waters here than I'm used to, but I sincerely want to understand errors like this and be able to get to bottom of issues. From what I understand, Drupal is warning me that my newly created /home/cathchar/config/sync directory is not in a path, namely /home/cathchar/www (the webroot) or the account root /tmp directory, that it can work with/write to. It's also warning me that that it doesn't see this directory as existing.

My question

The directory obviously exists, but what am I missing? PHP should have no problem with seeing outside of and jumping out of the webroot, correct? Do I have to inform Drupal somewhere else about a new path to work in? None of the tutorials/instructions I've read ever mention issues regarding directory access, paths, or open_basedir restrictions. The ones I encountered make it seem like adjusting settings.php and creating the non-webroot directory is really all it takes. I'm a bit stumped.

Any help that anyone could provide would be greatly appreciated!

Answer 1

PHP should have no problem with seeing outside of and jumping out of the webroot, correct?

Very much not! As the errors are telling you, your server config explicitly doesn't allow that to happen. You have PHP locked down to only be able to read from certain paths; /home/cathchar/config and/or /home/cathchar/config/sync don't belong to that list, so PHP can't read files from them.

Do I have to inform Drupal somewhere else about a new path to work in?

No...Drupal doesn't need to be told about file system restrictions, it just consumes the environment it finds itself in, and invariably complains if it can't access what it's (implicitly) been told it can have access to.

This should ideally be solved in your vhost/FPM config by setting an open_basedir which includes all of the paths that PHP needs to be able to read from (separated by a ;).

None of the tutorials/instructions I've read ever mention issues regarding directory access, paths, or open_basedir restrictions

The docs don't really try to cover every possible configuration scenario, it's probably assumed that if you're doing something more advanced like moving a folder out of the web root that you're happy configuring the rest of the server to allow it to happen.