I have this config:
Ubuntu, nginx, php-fpm; nginx speaks to php-fpm through tcp.

related config part of nginx:

[CODE]
server {
listen 80;
server_name *.sample.net;


access_log /var/www/sample/logs/access_log;
error_log /var/www/sample/logs/error_log;
access_log /var/log/apache_common_access_log;

root /var/www/sample/httpdocs/somedir;
index index.html index.htm index.php;


# redirect all www to non-www
if ($host ~* ^www\.(.*))
{
set $host_without_www $1;
rewrite ^/(.*)$ $scheme://$host_without_www/$1 permanent;
}


location / {
if (-f $document_root/error_page.html ) {
error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 495 496 497 500 501 502 503 504 505 506 507 /error_page.html;
}
}

location ~ \.php$ {
root /var/www/sample/httpdocs/somedir;
access_log /var/log/nginx/debug-fpm.log debug_phpfpm;
include fastcgi_params;
try_files $uri =404;

fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

}


location ~ /\.ht {
deny all;
}
}
[/CODE]


the problem is this:
I place a php file inside /var/www/sample/httpdocs/somedir,
Although the config has root (document_root) of /var/www/sample/httpdocs/somedir , the php file is able to read contents from upper dirs, such as /var, or even /

I debug the php-fpm, and checked if it receives document_root variables, by doing:

( http://forum.nginx.org/read.php?3,3651 )

put this in fastcgi_params:
[CODE]
fastcgi_param DEBUG "uri=$uri request_uri=$request_uri
request_filename=$request_filename query_string=$query_string is_args=
$is_args document_uri=$document_uri document_root=$document_root args=
$args fastcgi_script_name=$fastcgi_script_name";
[/CODE]

included this in php:
[CODE]echo $_SERVER["DEBUG"];[/CODE]

and I saw the output of test.php, as expected:
uri=/test.php request_uri=/test.php request_filename=/var/www/sample/httpdocs/somedir/test.php query_string= is_args= document_uri=/test.php document_root=/var/www/sample/httpdocs/somedir args= fastcgi_script_name=/test.php


This showed me that nginx sets document_root as expected, and that is recieved by php-fpm.

[B]However, that document_root has no effect. This is main problem [/B]

Any advice why is this ?

Look at your php.ini file and use for example this:

[PATH=/webroot/ww.name.nl]
open_basedir = /webroot/ww.name.nl
doc_root = /webroot/ww.name.nl

php can still read files when system("ls -l /") is executed inside php.
the only affect of doc_root or open_basedir: php cannot include files outside doc_root, (and possible cannot open files with fopen)
however, system(".....") command works directly, without doc_root in effect.



Edited 1 time(s). Last edit at 02/24/2013 05:29PM by bvidinli.

Which is why you also need something like:

disable_functions = "curl_exec,curl_multi_exec,dl,exec,parse_ini_file,passthru,popen,proc_open,proc_close,shell_exec,show_source,symlink,system"

For each host.