Socket Permission

[Blackglade]

I'm trying to use HHVM as a fastcgi server to communicate with nginx over socket. I specified the socket to be created at /var/run/hhvm/sock and passed that url onto my fastcgi_pass option. Every time I try to execute a php file I get a permission denied error because nginx doesn't have permission to use the socket. The only two options I see is to either run a chmod/chown command at run time every time on the socket file while hhvm is running for nginx to access it or to either somehow specify it to run under the nginx user. I wonder if there is any option to accomplish the latter?

[SiebelsTim]

hhvm --help
[...]
  -u [ --user ] arg                     run server under this user account
[...]

[Blackglade]

I tried that. I also tried setting the value hhvm.server.user = nginx. It doesn't change the owner/group of the socket and hhvm is still run under root

[andrewmclagan]

bump also experiencing this problem...

[maclof]

+1 I'm suprised this hasn't been fixed yet. Unix file sockets with HHVM are completely unusable.

[andrewmclagan]

chmod-ing the socket once it is created. Seems the only way to do this at present.

I would like to use unix socket as we run nginx and hhvm within a single docker container. We do not need requests going through the full TCP stack for no reason...

[pribeh]

I'm getting a 502 bad gateway and in the logs "connect() to unix:/var/run/hhvm/hhvm.sock failed (111: Connection refused) while connecting to upstream". Could this socket permission issue explain these errors?

[d4r5c0d3]

I was able to get around this issue by not providing the user with -c flag in my systemd conf file.
Instead I provided the user and group manually

User=apache
Group=www-data

my current config file https://gist.github.com/DaRamirezSoto/60d1283d46e65b51cda6d64f26a32f79

I added nginx to my www-data group so it was able to read and write to the socket via group permissions. I tried many other things but this seems to be the one that was most solid to me.

On a side note: I would love that hhvm would support de php-fpm settings like

• listen.owner string
• listen.group string
• listen.mode string
• listen.acl_users string
• listen.acl_groups

Which is the proper way how to solve this issue looking at how most distros handle php-fpm

[lexidor]

I am going over old issues on this repository, to see which ones apply to the current versions of hhvm.

The low level hsl primitives (in HH\Lib\Unix namespace) are the blessed (well tested) way to do socket IO in 202x. These primitives are built on low-level components and their permission handling works correctly (in my couple quick experiments).

If you experience issues with the modern APIs that I didn't uncover, please feel free to file a new bug.