Symfony 6.2生产环境部署遇polyfill-mbstring权限拒绝错误求助

在搭载Apache2的生产服务器部署Symfony 6.2项目，服务器已有旧版Symfony项目，通过ondrej php源安装了PHP8.2及相关模块。部署Git项目并执行composer install后，配置虚拟主机后出现权限拒绝错误：无法打开/var/www/project/vendor/symfony/polyfill-mbstring/bootstrap.php，本地Ubuntu/Apache2环境相同配置可正常运行。

服务器信息 #

Server version: Apache/2.4.41 (Ubuntu)

虚拟主机配置（project.conf） #

<virtualHost *:80>

  ServerAdmin admin@mysterty.com
  ServerName project.mysterty.com
  DirectoryIndex index.php

  DocumentRoot "/var/www/project/public"
  <Directory "/var/www/project/public">
                AllowOverride All
                Order Allow,Deny
                Allow from All
                Require all granted

                <IfModule mod_negotiation.c>
                        Options -MultiViews
                </IfModule>

                <IfModule mod_rewrite.c>
                        Options +FollowSymlinks

                        RewriteEngine On
                        RewriteCond %{REQUEST_URI}::$0 ^(/.+)/(.*)::\2$
                        RewriteRule .* - [E=BASE:%1]

                        RewriteCond %{HTTP:Authorization} .+
                        RewriteRule ^ - [E=HTTP_AUTHORIZATION:%0]

                        RewriteCond %{ENV:REDIRECT_STATUS} =""
                        RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
                        RewriteCond %{REQUEST_FILENAME} !-f
                        RewriteRule ^ %{ENV:BASE}/index.php [L]
                </IfModule>

                <IfModule !mod_rewrite.c>
                        <IfModule mod_alias.c>
                                # 当mod_rewrite不可用时，临时重定向首页到前端控制器，确保网站及生成链接可正常使用
                                RedirectMatch 307 ^/$ /index.php/
                                # 不可使用RedirectTemp替代
                        </IfModule>
                </IfModule>

  </Directory>

    <FilesMatch \.php$>
      # Apache 2.4.10及以上版本，使用SetHandler将PHP作为FastCGI进程服务器运行
      SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost"
    </FilesMatch>

  ErrorLog ${APACHE_LOG_DIR}/project_error.log
  CustomLog ${APACHE_LOG_DIR}/project_access.log combined

</VirtualHost>

错误日志 #

[Tue Apr 11 11:49:40.112857 2023] [proxy_fcgi:error] [pid 3184524] [client 194.38.23.179:63349] AH01071: Got error 'PHP message: PHP Warning:  require(/var/www/project/vendor/composer/../symfony/polyfill-mbstring/bootstrap.php): Failed to open stream: Permission denied in /var/www/project/vendor/composer/autoload_real.php on line 78; PHP message: PHP Fatal error:  Uncaught Error: Failed opening required '/var/www/project/vendor/composer/../symfony/polyfill-mbstring/bootstrap.php' (include_path='.:/usr/share/php') in /var/www/project/vendor/composer/autoload_real.php:78
Stack trace:
#0 /var/www/project/vendor/composer/autoload_real.php(61): composerRequiree6ce3b729b7a527d4ebd0a97b86ba908()
#1 /var/www/project/vendor/autoload.php(7): ComposerAutoloaderInite6ce3b729b7a527d4ebd0a97b86ba908::getLoader()
#2 /var/www/project/vendor/autoload_runtime.php(5): require_once('...')
#3 /var/www/project/public/index.php(5): require_once('...')
#4 {main}
  thrown in /var/www/project/vendor/composer/autoload_real.php on line 78'

解决方案 #

1. 修正文件与目录权限 #

Apache/PHP-FPM进程默认以www-data用户运行，确保项目目录及文件对该用户有读取权限：

• 递归设置目录权限为755，文件权限为644：

sudo chmod -R 755 /var/www/project
sudo chmod -R 644 /var/www/project/*

• 修正目录及文件的所有者：

sudo chown -R www-data:www-data /var/www/project

2. 验证PHP-FPM运行用户 #

确认PHP8.2-FPM的运行用户是否为www-data，查看配置文件：

cat /etc/php/8.2/fpm/pool.d/www.conf | grep user

若显示user = www-data则正常，否则修改配置后重启PHP-FPM：

sudo systemctl restart php8.2-fpm

3. 检查SELinux状态（若启用） #

如果服务器启用了SELinux，可能会阻止PHP访问vendor目录，临时关闭验证：

sudo setenforce 0

若问题解决，需配置SELinux规则允许访问：

sudo chcon -R -t httpd_sys_rw_content_t /var/www/project/vendor

4. 重新执行Composer安装 #

确保composer install以正确用户权限执行，避免生成的文件权限异常：

sudo -u www-data composer install --no-dev -o

内容的提问来源于stack exchange，提问作者mysterty