title: How do I chroot php-fpm (7.3) for use with Apache 2.4.10?
body: <p>I would like to chroot my php-fpm service to /var/www/html for security reasons. I have a vhost in Apache 2.4.10 that looks like this:</p>
  
  <pre><code>&lt;VirtualHost *:8080&gt;
          DocumentRoot /var/www/html
          DirectoryIndex index.php index.html /index.php /index.html
  
          &lt;FilesMatch \.php$&gt;
                  SetHandler "proxy:unix:/run/php/php7.3-fpm.sock|fcgi://localhost/"
          &lt;/FilesMatch&gt;
  
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>My problem is when I set <code>chroot = /var/www/html</code> in the pool .conf in php-fpm, the file paths sent from Apache are incorrect (due to the <code>DocumentRoot</code> it will set SCRIPT_FILENAME to <code>/var/www/html/index.php</code>, when php-fpm would now expect <code>/index.php</code>). I can kind of work around this by doing <code>AliasMatch \.php$ /</code> to get my php files out of the <code>DocumentRoot</code> folder, but this prevents the <code>DirectoryIndex</code> from working, because now Apache looks for <code>/index.php</code> as the index file, which doesn't exist. I'm assuming this is probably also pretty bad form...</p>
  
  <p>Is there a way to handle this? I know nginx can get around this by rewriting SCRIPT_FILENAME, but this isn't an option for me. I also know I can set the <code>doc_root</code> php.ini option, but I've heard this can be a problem because it affects the <code>$_SERVER</code> variables related to the script path in php.</p>
  
  <p>On a related note, how insecure is it to run php-fpm not in a chroot? (I have set <code>open_basedir</code> to /var/www/html)</p>