Hello!

We have noticed that the PHP configuration file installed by default
with the PHP 8.4 package contains a note that states that cleaning up
session files on Debian, specifically is offloaded as a task to Cron.
Specifically, here is the quote from a "php.ini" file:

; This is disabled in the Debian packages due to the strict permissions
; on /var/lib/php. Instead, GC is performed through /etc/cron.d/php,
; which uses the session.gc_maxlifetime setting. Please, check
; /usr/share/doc/php8.2-common/README.Debian.gz for further reference.
session.gc_probability = 0

However, the php8.4 package does not mark the "cron" package as a
dependency such that it invariably leads to filling up the session
directory with session files given that nothing else is cleaning up the
session files.

Aside from using up a lot of hard-drive space, when and if the session
directory fills, then the services start failing, and PHP complains that
there is no more space to create session files.

In case the decision will be to maintain the PHP configuration as-is
then it would be advisable to make the PHP packages depend on Cron such
that they can be installed together.

Thank you!

Thanks, this makes sense (although for a different package).

Ondrej
--
Ondřej Surý (He/Him)
ondrej@sury.org

Welcome and thank you for the response! Sorry, was not really sure which
one was the relevant package. "php-fpm" or "php8.4-fpm" seems to use a
different "php.ini" than PHP ran from the CLI. When PHP installed, there
are two "php.ini" created (it gets confusing):

cd /etc/php/

find -name "php.ini"

./8.4/cli/php.ini
./8.4/fpm/php.ini

and from what I remember they apply separately depending on whether PHP
is ran from the command line vs. if PHP is ran as a CGI server for a
webserver.

Admittedly, both CLI and FPM pull "php-common" so adding the dependency
to "php-common" should work.

As a case example, this is very easily discovered if you play around
with Docker, because "cron" is one of those packages that gets pulled
for right about any typical Debian install but on Docker, the "debian"
and "debian-slim" images obviously do not install "cron" in order to
keep the size down so installing PHP within the container will
immediately leads to this problem with the session files piling up.

Unfortunately this means all installations of PHP now pull in cron,
systemd(-standalone-sysusers) and by default even exim4, including
CLI-only installations. This isn't great for minimal containers and
development environments. The least intrusive solution is to `apt
install anacron php-common --no-install-recommends; [ -x
/usr/bin/systemctl ] && systemctl disable --now anacron` to resolve the
dependency peacefully.

Any chance this dependency could be moved over to php-fpm or changed
into a Recommends? The latter actually seems more sensible since most
apps don't use sessions in the first place or may change
session.save_handler. This would also be in line with other packages
that still ship cronjobs that aren't necessarily required; some don't
mention cron in their control at all (man-db, check-dfsg-status,
rkhunter) or just recommend it (chkrootkit).