execute gpg from php

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
I'm pretty new to php\linux and I'm trying to encrypt a file using gpg from
a php page on a linux box and it's not working.  The following code works
for executing 'ls', but not gpg...

$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write
   2 => array("file", "/tmp/error-output.txt", "a") // stderr is a file to
write to

//$process = proc_open(gpg --output encmail.txt --recipient
someone@domain.com --always-trust --armor --yes --encrypt mail.txt",
$descriptorspec, $pipes);

$process = proc_open("ls", $descriptorspec, $pipes);

if (is_resource($process)) {
   while (!feof($pipes[1])) {
       echo fgets($pipes[1], 1024);

   $return_value = proc_close($process);

   echo "command returned $return_value\n";

When I try to execute gpg, the value returned is 2, but that means nothing
to me.  Am I doing something wrong from the php side of things or am I
overlooking something on the server?


Re: execute gpg from php


Quoted text here. Click to load it

 This would give a parse error when uncommented. What code did you really try?

Quoted text here. Click to load it

 Is there anything in /tmp/error-output.txt ? Do you have permissions to write
to there in the first place?

 If it didn't get that far, then it'll be the underlying exec* call that
generated an error. You've said you're on Linux, so looking up error codes in
Linux shows that 2 is:

#define ENOENT           2      /* No such file or directory */

 Is gpg on the PATH environment variable as seen by the webserver? Try
specifying a complete path to the executable.

 Is gpg executable by the user the webserver runs as?

<http://www.andyhsoftware.co.uk/space Space: disk usage analysis tool

Re: execute gpg from php

Thanks for the response.

Here's the line that doesn't work, it was just missing a " in front of the
gpg command...
$process = proc_open("gpg --output encmail.txt --recipient
someone@domain.com --always-trust --armor --yes --encrypt mail.txt",
$descriptorspec, $pipes);

I temporarily gave the Apache user full rights, I can ssh to the server, su
to apache, and execute the gpg command above in the proc_open call without a
hitch; so gpg is on the PATH variable and it's executable by the apache

Here's the error message in /tmp/error-output.txt... gpg: fatal:
/root/.gnupg: can't create directory: Permission denied.

I don't get it.  If I can run the gpg command successfullty from the command
line as the apache user, why would the apache user not be able to run the
gpg command from a php page?


Quoted text here. Click to load it
Quoted text here. Click to load it

Re: execute gpg from php


Quoted text here. Click to load it

 The webserver is unlikely to ever be able to write to root's home directory -
at least you'd hope so!

Quoted text here. Click to load it

 Apache initially starts as root (so it can bind to port 80), but the child
process that ends up serving requests gets setuid down to a less privileged
user. It may well be that there are remnants of root's environment variables
inherited into the child process's environment, enough that gpg thinks it
should be creating directories in /root.

 Whereas, when you log in as the apache user, all you get is the apache user's
environment. So the environment would point to the user's own home directory,
which would be writable.

 man gpg says:

       Long  options  can  be put in an options file (default
Quoted text here. Click to load it

 Sounds like it's seeing $HOME=/root then. Apache on my test server has HOME=/
- which also wouldn't work well here.

 Later it has:

       --homedir directory
                 Set the name of the home directory to directory If this option
is not used it  defaults  to
                 "~/.gnupg".  It  does not make sense to use this in a options
file. This also overrides the
                 environment variable "GNUPGHOME".
Quoted text here. Click to load it

 Try using that to point to a more appropriate directory. I've not used gpg
personally, so there may be more issues.

<http://www.andyhsoftware.co.uk/space Space: disk usage analysis tool

Site Timeline