#1143109 Reconsider `ProtectHome` for sessionclean

Package:
php-common
Source:
php-common
Submitter:
William David Edwards
Date:
2026-07-31 15:43:02 UTC
Severity:
normal
Tags:
#1143109#5
Date:
2026-07-30 13:36:49 UTC
From:
To:
`phpsessionclean.service` (which runs `/usr/lib/php/sessionclean`)
contains `ProtectHome=true`. This is obviously problematic when storing
session files in /home/, which is not uncommon. Due to systemd's
implementation details (exposing /home/ but simply returning an empty
directory listing), this causes session files to not be cleaned up. The
cleanup process effectively fails silently.

I therefore urge the package maintainers to re-consider the default
ProtectHome behaviour, especially seeing as how I'm unsure why this
setting is necessary (protecting against too broad `find -delete`s)?

Met vriendelijke groeten,

William David Edwards
#1143109#10
Date:
2026-07-30 14:46:12 UTC
From:
To:
Hi,

I don't think this is a good idea. The defaults should be secure, but wide enough.

I would actually dispute this. I don't think this is common at all. If you change the defaults
where the session files are stored, you might as well change the systemd unit that cleans
the session files.

Cheers,
Ondrej
--
Ondřej Surý (He/Him)
ondrej@sury.org

A gentle nudge is always appreciated if I take a little longer to reply.
#1143109#19
Date:
2026-07-30 14:46:12 UTC
From:
To:
Hi,

I don't think this is a good idea. The defaults should be secure, but wide enough.

I would actually dispute this. I don't think this is common at all. If you change the defaults
where the session files are stored, you might as well change the systemd unit that cleans
the session files.

Cheers,
Ondrej
--
Ondřej Surý (He/Him)
ondrej@sury.org

A gentle nudge is always appreciated if I take a little longer to reply.
#1143109#24
Date:
2026-07-30 14:57:50 UTC
From:
To:
Hi Ondřej,

Ondřej Surý schreef op 2026-07-30 16:46:
`ProtectHome` provide in the sessionclean scenario?

Fair enough. I guess 'common in the web hosting space' does not equate
to 'common'. And yes, creating an override is not a problem at all.

Met vriendelijke groeten,

William David Edwards
#1143109#29
Date:
2026-07-30 14:57:50 UTC
From:
To:
Hi Ondřej,

Ondřej Surý schreef op 2026-07-30 16:46:
`ProtectHome` provide in the sessionclean scenario?

Fair enough. I guess 'common in the web hosting space' does not equate
to 'common'. And yes, creating an override is not a problem at all.

Met vriendelijke groeten,

William David Edwards
#1143109#34
Date:
2026-07-31 15:40:06 UTC
From:
To:
[..]

/home is nowadays understood and expected to contain the "$HOME"
directories for real, likely interactive users. ProtectHome and
other mechanisms are designed to prevent leaking personal data,
documents, etc. of such users.

I imagine "in the web hosting space" you do not have such users,
and then nowadays the various components making up the distro would
expect you to store impacted files outside of /home.

Hope this helps.

Best,
Chris
#1143109#39
Date:
2026-07-31 15:40:06 UTC
From:
To:
[..]

/home is nowadays understood and expected to contain the "$HOME"
directories for real, likely interactive users. ProtectHome and
other mechanisms are designed to prevent leaking personal data,
documents, etc. of such users.

I imagine "in the web hosting space" you do not have such users,
and then nowadays the various components making up the distro would
expect you to store impacted files outside of /home.

Hope this helps.

Best,
Chris