Repository navigation
php-fpm is trying to read the entire / by default #25022
Description
Description
The following Apparmor profile for PHP-FPM:
abi <abi/4.0>,
include <tunables/global>
/usr/sbin/php-fpm8.4 {
include <abstractions/base>
include <abstractions/php>
capability chown,
capability dac_override,
capability kill,
capability net_admin,
capability setgid,
capability setuid,
....Resulted in this output:
apparmor="DENIED" operation="file_mmap" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/php-fpm8.4"
But I expected this output instead:
(No error)
And when I change the flag like this and restarted php-fpm,
/usr/sbin/php-fpm8.4 flags=(attach_disconnected) {
PHP-FPM tried to read entire /!
apparmor="DENIED" operation="file_mmap" class="file" profile="/usr/sbin/php-fpm8.4" name="/"
Profile: /usr/sbin/php-fpm8.4
Path: /
New Mode: owner rw
Severity: unknown
[1 - owner / rw,]
(A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish
I removed flags=(attach_disconnected) for now but why PHP-FPM tried to read /?
PHP Version
PHP 8.4.27 (NTS)
Operating System
Linux
Activity
iliaal commentedon Oct 29, 2026
FPM doesn't read
/. Its only read-write shared mappings are anonymousmmap(MAP_SHARED|MAP_ANONYMOUS)regions (scoreboard, opcache SHM), which have no path in your namespace, hence the disconnected-path denial;attach_disconnectedreports such objects as/. That's a profile rule to add, not a PHP bug.