Prepare Output and the APPX Environment

Choose the directories and runtime account

PHP reads the ChartDirector library and example script, then writes a new chart image. The examples keep those three kinds of files in separate directories:

These locations are examples. Your paths, APPX runtime account and group will probably differ. Substitute your choices throughout the commands and the APPX parameter form. The commands below use account appx and group appxgrp. For a fresh system, complete the APPX installer in Chapter 5 first so that account and group exist. Check the account that actually runs your APPX sessions; the account used to install the software may be different.

Create the output and example directories

Run these commands from an administrator account permitted to use sudo:

sudo install -d -o appx -g appxgrp -m 0750 /var/lib/appx-charts
sudo install -d -o root -g root -m 0755 /opt/appx-chart-examples

The first command creates the chart-output directory with appx as its owner. The second creates the example-script directory with root as its owner. Both commands set directory attributes; they do not download scripts, install ChartDirector or create a chart. If a named directory already exists, install -d applies the requested ownership and permissions to that directory. Check your choices before running it against an existing installation.

The syntax is the same in both commands:

In these numeric modes, the leading 0 marks octal notation. The remaining three digits specify permissions for the owner, owning group and everyone else, in that order. Each digit adds read (4), write (2) and search/enter (1) permissions. For a directory, read permits listing names, write permits adding or removing directory entries, and search permits reaching files through that directory. Creating a file requires both write and search access to its directory.

With these choices, appx can create chart files in /var/lib/appx-charts. Members of appxgrp can list and enter that directory, but the mode does not give them permission to create files there. The example directory allows APPX to reach scripts installed by an administrator while reserving directory changes to root. Files inside either directory have their own permissions: a PHP script invoked through php needs read access, and does not need its executable bit set. These directory commands do not recursively change existing files.

Check write access as the APPX account

The command sudo -u appx test -w /var/lib/appx-charts runs test as appx. Here -u appx belongs to sudo and selects the account; -w belongs to test and asks whether the path is writable. test prints nothing. Its exit status is 0 when the test is true and 1 when it is false; a failure to run sudo can also produce a nonzero status.

Use this form to display a result:

if sudo -u appx test -w /var/lib/appx-charts; then
    printf '%s\n' 'PASS: appx has write access to the chart directory.'
else
    printf '%s\n' 'FAIL: check the APPX account, directory ownership and permissions.' >&2
fi

if runs the check. A zero exit status selects the commands after then; a nonzero status selects those after else. fi ends the conditional. printf prints the message, and >&2 sends the failure message to the error output. Resolve a failure before continuing.

This checks reported write access without creating a file. The PHP smoke test in Chapter 4 must still create a fresh PNG as the APPX account, and the APPX session must render its own chart. A successful administrator-shell check does not establish access from a service running in a different SELinux domain; follow the SELinux topic below.

Make PHP available to the APPX process

APPX invokes the command named php. Its PATH environment variable is the colon-separated list of directories searched for that command, from left to right. For an interactive test:

export PATH=/usr/bin:$PATH
command -v php
php --ini

export PATH=/usr/bin:$PATH puts /usr/bin first and retains the existing list through $PATH. export makes that value available to child processes started from this shell. command -v php shows which executable the shell selects; expect /usr/bin/php for this recipe. php --ini shows its configuration file and additional ini-file locations. Substitute the directory containing your selected PHP executable if it differs.

This export changes the current shell and its later child processes. It does not update an APPX session or service that is already running. For a systemd service, set PATH in that service's environment while preserving the entries it needs. After editing a unit or drop-in, reload systemd's unit definitions and restart the actual APPX service during maintenance. Your unit name and existing service configuration will differ by installation.

Continue with the SELinux checks below before testing from the APPX service.