ISPConfig 3 PHP Fatal Error after deb.sury.org PHP upgrade – IDS temp folder becomes read-only (syst

Discussion in 'Installation/Configuration' started by kwisarts, May 13, 2026 at 6:16 PM.

  1. kwisarts

    kwisarts New Member HowtoForge Supporter

    For anyone running into the same issue and scratching their heads:

    Symptoms

    After a PHP or system update (deb.sury.org packages), ISPConfig interface may fail with HTTP 500 errors.

    Webserver error log shows:
    Code:
    PHP Fatal error: Uncaught InvalidArgumentException: Please make sure the folder '/usr/local/ispconfig/interface/lib/classes/IDS/../../../temp' is writable in Monitor.php
    
    This resolves to:
    Code:
    /usr/local/ispconfig/interface/temp
    
    Strace / logs indicate:
    Code:
    access("/usr/local/ispconfig/interface/lib/classes/IDS/../../../temp", W_OK) = -1 EROFS (Read-only file system)
    
    Directory permissions appear correct:
    Code:
    drwxr-x--- ispconfig ispconfig /usr/local/ispconfig/interface/temp
    
    Root cause

    This is not a filesystem permission issue.

    Recent deb.sury.org PHP-FPM packages enable stricter systemd sandboxing, typically:
    • ProtectSystem=full
    This makes parts of the filesystem read-only inside the PHP-FPM service context, including:

    Code:
    /usr/local/ispconfig/interface/temp
    

    Even though it is writable on disk, systemd blocks write access at runtime.

    Reproduction:
    Code:
    systemd-run --pty --property=ProtectSystem=full touch /usr/local/ispconfig/interface/temp/foo
    
    Result:
    Code:
    Read-only file system
    
    And proving that adding ReadWritePaths does work by running this successfully:
    Code:
    systemd-run --pty --property=ProtectSystem=full --property=ReadWritePaths=/usr/local/ispconfig/interface/temp touch /usr/local/ispconfig/interface/temp/foo
    
    Fix

    Add an explicit write exception for the ISPConfig temp directory.

    Create or edit (systemctl edit php8.2-fpm):
    Code:
    /etc/systemd/system/php8.2-fpm.service.d/override.conf
    
    Add:
    Code:
    [Service]
    ReadWritePaths=/usr/local/ispconfig/interface/temp
    
    Apply changes

    Reload systemd and restart PHP-FPM (restart is required, not reload):
    Code:
    systemctl daemon-reload
    systemctl restart php8.2-fpm
    
    References

    ProtectSystem documentation:
    URL: https://linux-audit.com/systemd/settings/units/protectsystem/

    Related ISPConfig discussion:
    URL: https://forum.howtoforge.com/threads/ispconfig-error-500.93106/
     
    Taleman, pvanthony, till and 2 others like this.
  2. ressel

    ressel Member

  3. ahrasis

    ahrasis Well-Known Member HowtoForge Supporter

    @till have you noted this? Other than the suggested, I also noted that in the other thread it was resolved by an ISPConfig, so will ISPConfig have something built in to accommodate or prevent this occurrence in the future?
     
    pvanthony likes this.
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    I have not had such an issue yet. But I'll add it to the issue tracker so we can write a config file for that.
     
    ahrasis likes this.
  5. till

    till Super Moderator Staff Member ISPConfig Developer

  6. pvanthony

    pvanthony Active Member HowtoForge Supporter

    Thank you for the fix and sharing it in detail. Helped me. I do appreciate fix much.
     
  7. webmaster-eddie

    webmaster-eddie New Member


    So, would a relatively safe alternative be to simply disable IDS for anon and user until there is a patch for latest Ispconfig3 that takes the new hardened fpm security settings into effect? Or do you recommend leaving the IDS alone and applying this fix, and if so, will this fix be "corrected" or taken into account when the Ispconfig3 patch is released with the next ispconfig version?
     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    There is actually nothing that needs to be changed or patched in ISPConfig itself, as there is nothing wrong with ISPconfig code here. Ondrej changed a major configuration of his packages in between minor versions and in a way that differs from the config of the underlying Linux distributions. I understand his good intentions, but it is not a good move as he broke your systems. What we will do is add this new config file as described in the first post by the ISPConfig installer, if the system PHP version is not the one of the Linux distribution, but the one from Ondrej.
     

Share This Page