Take the 2-minute tour ×

I have several users running PHP scripts on a server and I'd like to lock it down so that their scripts can only access files in their www directory (it doesn't use linux user accounts, so there isn't a home directory).

open_basedir seems like the obvious choice but how can I set that parameter based on where the script is running from? Obviously the value for open_basedir would be different for each user.

I'm running PHP5-FPM - PHP5 as a FastCGI process which nginx connects to - on Ubuntu 11.04

Any help or advice appreciated!

share|improve this question
add comment

2 Answers

I've discovered the solution - php.ini directives based on the file path or request host. From the documentation:

open_basedir = /var/www/dev.site.com


open_basedir = /var/www/dev.site.com
share|improve this answer
add comment

Assuming you're using Apache, you should be able to set it within each VirtualHost instance with:-

php_admin_value open_basedir /path/to/restrict/to

Resist the temptation to use ., as the user can still change directory with chdir.

http://php.net/manual/en/ini.core.php has a bit more information, too.

share|improve this answer
Unfortunately I'm running PHP as a FastCGI process and connecting to it with nginx. I've updated my question just to clarify –  Tak Nov 30 '11 at 22:22
add comment

Your Answer


