10

PROBLEM

After upgrading to MacOS 10.15 Catalina PHP is having problems reading some links, and not others, runing PHP (As Apache's user "www"). The problem appears to be possibly changes to the OS privacy/security configuration, which we know has changed, rather than directory execution permisson / FollowSymLink permissions.

DETAILS

$ ls -alt /Users/[MYUSER]/Sites/*info.php
lrwxr-xr-x  1 [MYUSER]  staff   8 Oct 10 11:16 /Users/[MYUSER]/Sites/linfo.php -> info.php
-rwxr-xr-x  1 [MYUSER]  staff  25 Oct 30  2014 /Users/[MYUSER]/Sites/info.php

In the above both pages info.php and linfo.php function correctly which I think shows the FollowSymLinks working.

$ ls -alt /Users/[MYUSER]/Sites/*index.php
lrwxr-xr-x  1 [MYUSER]  staff  78 Dec 30  2014 /Users/[MYUSER]/Sites/index.php -> /Users/[MYUSER]/Documents/[ADIR]/Development/GitHub/cms/sitesIndex.php
$ ls -alt /Users/[MYUSER]/Sites/sitesIndex.php
-rwxr-xr-x  1 [MYUSER]  staff  20847 Oct  8 13:11 sitesIndex.php

Of the above pages index.php, a link fails where as a copy of the linked file sitesIndex.php succeeds.

BACKGROUND

Though I don't believe it is related (Because an inability to followSymLinks has a different error message), the folling is the FollowSymLinks setting.

<Directory "/Users/*/Sites/">
    Options Indexes MultiViews FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>

$ cat $HOME/Sites/.htaccess
Options +FollowSymLinks

The web server runs as the user "www".

Apache is being initiated as root, though the worker threads run as _www as expected.

_www             65500   0.0  0.0  4317396   1288   ??  S     9:56AM   0:00.02 /usr/sbin/httpd -D FOREGROUND
_www             28574   0.0  0.0  4317440   2256   ??  S    12:16PM   0:00.03 /usr/sbin/httpd -D FOREGROUND
_www             28546   0.0  0.0  4317520   2612   ??  S    12:15PM   0:00.06 /usr/sbin/httpd -D FOREGROUND
root             28529   0.0  0.0  4317548   1284   ??  Ss   12:15PM   0:04.56 /usr/sbin/httpd -D FOREGROUND

All of these files within $HOME/Sites are under iCloud and we are told in the release notes that there are new additional privacy restrictiions introduced in 10.15 for iCloud directories, but it isn't clear to me what these restrictions are, or if the restrictions are documented.

ERRORS

In the server response page PHP produces the following errors:

Warning: Unknown: failed to open stream: Operation not permitted in Unknown on line 0

Fatal error: Unknown: Failed opening required '/Users/owenbrunette/Sites/index.php' (include_path='.:') in Unknown on line 0

And in the error.log:

[Tue Oct 08 21:49:11.855033 2019] [php7:warn] [pid 83605] [client ::1:64968] PHP Warning:  Unknown: failed to open stream: Operation not permitted in Unknown on line 0, referer: http://localhost/
[Tue Oct 08 21:49:11.855078 2019] [php7:error] [pid 83605] [client ::1:64968] PHP Fatal error:  Unknown: Failed opening required '/Users/[MYUSER]/Sites/index.php' (include_path='.:') in Unknown on line 0, referer: http://localhost/

I have done a lot of file checking. The UNIX read and execute flags for other are set for all the directories leading to the files.

ATTEMPTS AT A SOLUTION

The error of "operation not permitted" is an error string associated with System Integrety Protection" under MacOS, and not Apache SymLink following, though the pharese "operation not permitted", may well not be unique. The error is coming from PHP not Apache..

I have allowed full disk access in: System Preferences / Security & Privacy / Privacy / Full Disk Access.

I have not tried completely disabling SIP (System Integrity Protection) at the OS level, as that is far from an ideal solution.

1
  • I have since disabled SIP (System Integrity Protection) which does not resolve the issue. Oct 16, 2019 at 13:30

1 Answer 1

25

Catalina has more restrictive permissions. The fix is easy: enable full disk access for http. To do this:

System Preferences => Security & Privacy => Full Disk Access

Navigate to the root folder of the disk and press Cmd+Shift+. (to view all the folders under root) and then go to

/usr/sbin/

select "httpd" and restart it (apachectl -k restart).

That should do the trick.

8
  • I'm having a hard time following this. Do you mean to open System Preferences => Security & Privacy => Full Disk Access => Privacy, then add /usr/sbin/httpd to the list? Then, once that is done, manually restart httpd?
    – Z4-tier
    Oct 19, 2019 at 0:04
  • 1
    I had the same thought, but as noted in the second from last paragraph of the question I have already allowed full disk access to httpd and restarted httpd. Unfurtunately it doesn't resolve the issue. Neither does rebooting after this. Oct 19, 2019 at 21:48
  • Z4-tier: YES. ClearCrescendo: Bummer, and sorry for misunderstanding your full disk access note (thought you were referring to PHP, not httpd). Sounds like iCloud directories are raining on your parade? Oct 20, 2019 at 2:14
  • 1
    This should be the correct answer, deserves an upvote. It resolves my problem.
    – Ken Tan
    Oct 23, 2019 at 14:56
  • 1
    I got around the file permission restrictions by setting an ACL on the Documents folder (Sites in your case). It's a more fine-grained options than a blanket "full disk access". See my answer here.
    – zan
    Aug 6, 2020 at 23:55

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.