VestaCP: open_basedir restriction while using app/autoload.php

I deploy Symfony3 project on server (Ubuntu 16.04, PHP 7.0.18). I use VestaCP, create symlinl public_shtml -> www/web and place project in www directory.

I execute following commands:

git clone
composer install
setfacl (from official Symfony documentation)

In error log I see that messages:

PHP Warning: require(): open_basedir restriction in effect. File(/home/admin/web/project/www/app/autoload.php) is not within the allowed path(s): (/home/admin/web/project/public_shtml:/home/admin/tmp) in /home/admin/web/project/www/web/app.php on line 6

PHP Warning: require(/home/admin/web/project/www/app/autoload.php): failed to open stream: Operation not permitted in /home/admin/web/project/www/web/app.php on line 6

PHP Fatal error: require(): Failed opening required '/home/admin/web/project/www/web/../app/autoload.php' (include_path='.:/usr/share/php') in /home/admin/web/project/www/web/app.php on line 6

What do I doing wrong?

Solution

You need to change open_basedir parameter in config for apache (/home/admin/conf/web/apache2.conf and /home/admin/conf/web/sapache2.conf) to point to your newly created folder /home/admin/web/project/www:

<Directory /home/admin/web/project/www/web>
    AllowOverride All
    Options +Includes -Indexes +ExecCGI
    php_admin_value open_basedir /home/admin/web/project/www:/home/admin/tmp
    php_admin_value upload_tmp_dir /home/admin/tmp
    php_admin_value session.save_path /home/admin/tmp
</Directory>

VestaCP uses open_basedir restriction to make more secure default configuration.

Also if you plan to add more websites to your server I recommend you to make special apache config template for your symfony projects at path /usr/local/vesta/data/templates/web/apache2/. You can copy default templates default.tpl and default.stpl as new files symfony.tpl and symfony.stpl where you can change open_basedir, DocumentRoot and Directory parameters. If you will not do it: every time after adding/updating configurations for your user's sites VestaCP will replace your current configuration with new generated config using default template and you will need to edit it again.