{"action":"created","issue":{"url":"https://api.github.com/repos/debops/ansible-owncloud/issues/34","repository_url":"https://api.github.com/repos/debops/ansible-owncloud","labels_url":"https://api.github.com/repos/debops/ansible-owncloud/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/debops/ansible-owncloud/issues/34/comments","events_url":"https://api.github.com/repos/debops/ansible-owncloud/issues/34/events","html_url":"https://github.com/debops/ansible-owncloud/issues/34","id":131470156,"number":34,"title":"PHP5 open_basedir for ownCloud","user":{"login":"drybjed","id":1043958,"avatar_url":"https://avatars.githubusercontent.com/u/1043958?v=3","gravatar_id":"","url":"https://api.github.com/users/drybjed","html_url":"https://github.com/drybjed","followers_url":"https://api.github.com/users/drybjed/followers","following_url":"https://api.github.com/users/drybjed/following{/other_user}","gists_url":"https://api.github.com/users/drybjed/gists{/gist_id}","starred_url":"https://api.github.com/users/drybjed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drybjed/subscriptions","organizations_url":"https://api.github.com/users/drybjed/orgs","repos_url":"https://api.github.com/users/drybjed/repos","events_url":"https://api.github.com/users/drybjed/events{/privacy}","received_events_url":"https://api.github.com/users/drybjed/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-04T20:50:25Z","updated_at":"2016-02-04T21:12:22Z","closed_at":null,"body":"Because after the switch to the packaged ownCloud the user that runs the `php5-fpm` processes is `www-data`, maybe a good idea would be to restrict it to only the directories that the application needs? I imagine that would be something like:\r\n\r\n- `/tmp`\r\n- `/usr/share/php5`\r\n- `/var/www/owncloud`\r\n\r\nProbably something else as well. That should prevent the ownCloud's `www-data` instance messing with other directories accessible by `www-data` user. Thoughts?"},"comment":{"url":"https://api.github.com/repos/debops/ansible-owncloud/issues/comments/180052997","html_url":"https://github.com/debops/ansible-owncloud/issues/34#issuecomment-180052997","issue_url":"https://api.github.com/repos/debops/ansible-owncloud/issues/34","id":180052997,"user":{"login":"drybjed","id":1043958,"avatar_url":"https://avatars.githubusercontent.com/u/1043958?v=3","gravatar_id":"","url":"https://api.github.com/users/drybjed","html_url":"https://github.com/drybjed","followers_url":"https://api.github.com/users/drybjed/followers","following_url":"https://api.github.com/users/drybjed/following{/other_user}","gists_url":"https://api.github.com/users/drybjed/gists{/gist_id}","starred_url":"https://api.github.com/users/drybjed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drybjed/subscriptions","organizations_url":"https://api.github.com/users/drybjed/orgs","repos_url":"https://api.github.com/users/drybjed/repos","events_url":"https://api.github.com/users/drybjed/events{/privacy}","received_events_url":"https://api.github.com/users/drybjed/received_events","type":"User","site_admin":false},"created_at":"2016-02-04T21:12:22Z","updated_at":"2016-02-04T21:12:22Z","body":"Having a separate user for ownCloud PHP application would probably be best. Any owner/group changes needed for ownCloud to work, like `/var/www/owncloud/data/` and similar could probably be handled by `dpkg-statoverride`."}}