From e1932717fdadb476124197f4f634c4b21f933ade Mon Sep 17 00:00:00 2001
From: Mikhail Galanin <mikhail.galanin@team.bumble.com>
Date: Thu, 6 Jan 2022 17:09:40 +0000
Subject: [PATCH 1/2] Add "error_log_mode" setting

---
 main/main.c        | 14 ++++++++++++--
 main/php_globals.h |  1 +
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/main/main.c b/main/main.c
index a0f1a658c661a..77136425e3265 100644
--- a/main/main.c
+++ b/main/main.c
@@ -712,7 +712,8 @@ PHP_INI_BEGIN()
 	STD_PHP_INI_ENTRY("internal_encoding",		NULL,			PHP_INI_ALL,	OnUpdateInternalEncoding,	internal_encoding,	php_core_globals, core_globals)
 	STD_PHP_INI_ENTRY("input_encoding",			NULL,			PHP_INI_ALL,	OnUpdateInputEncoding,				input_encoding,		php_core_globals, core_globals)
 	STD_PHP_INI_ENTRY("output_encoding",		NULL,			PHP_INI_ALL,	OnUpdateOutputEncoding,				output_encoding,	php_core_globals, core_globals)
-	STD_PHP_INI_ENTRY("error_log",				NULL,		PHP_INI_ALL,		OnUpdateErrorLog,			error_log,				php_core_globals,	core_globals)
+	STD_PHP_INI_ENTRY("error_log",				NULL,			PHP_INI_ALL,		OnUpdateErrorLog,				error_log,				php_core_globals,	core_globals)
+	STD_PHP_INI_ENTRY("error_log_mode",			"0644",			PHP_INI_ALL,		OnUpdateLong,					error_log_mode,			php_core_globals,	core_globals)
 	STD_PHP_INI_ENTRY("extension_dir",			PHP_EXTENSION_DIR,		PHP_INI_SYSTEM,		OnUpdateStringUnempty,	extension_dir,			php_core_globals,	core_globals)
 	STD_PHP_INI_ENTRY("sys_temp_dir",			NULL,		PHP_INI_SYSTEM,		OnUpdateStringUnempty,	sys_temp_dir,			php_core_globals,	core_globals)
 	STD_PHP_INI_ENTRY("include_path",			PHP_INCLUDE_PATH,		PHP_INI_ALL,		OnUpdateStringUnempty,	include_path,			php_core_globals,	core_globals)
@@ -807,6 +808,8 @@ PHPAPI ZEND_COLD void php_log_err_with_severity(const char *log_message, int sys
 
 	/* Try to use the specified logging location. */
 	if (PG(error_log) != NULL) {
+		int error_log_mode;
+
 #ifdef HAVE_SYSLOG_H
 		if (!strcmp(PG(error_log), "syslog")) {
 			php_syslog(syslog_type_int, "%s", log_message);
@@ -814,7 +817,14 @@ PHPAPI ZEND_COLD void php_log_err_with_severity(const char *log_message, int sys
 			return;
 		}
 #endif
-		fd = VCWD_OPEN_MODE(PG(error_log), O_CREAT | O_APPEND | O_WRONLY, 0644);
+
+		error_log_mode = 0644;
+
+		if (PG(error_log_mode) > 0 && PG(error_log_mode) <= 0777) {
+			error_log_mode = PG(error_log_mode);
+		}
+
+		fd = VCWD_OPEN_MODE(PG(error_log), O_CREAT | O_APPEND | O_WRONLY, error_log_mode);
 		if (fd != -1) {
 			char *tmp;
 			size_t len;
diff --git a/main/php_globals.h b/main/php_globals.h
index 80152663f4403..cbf0271c7b763 100644
--- a/main/php_globals.h
+++ b/main/php_globals.h
@@ -165,6 +165,7 @@ struct _php_core_globals {
 	char *syslog_ident;
 	bool have_called_openlog;
 	zend_long syslog_filter;
+	zend_long error_log_mode;
 };
 
 

From 2eddd3322e48c030d2a20f90fb1b392ad67e15d5 Mon Sep 17 00:00:00 2001
From: Mikhail Galanin <mikhail.galanin@team.bumble.com>
Date: Fri, 28 Jan 2022 13:39:39 +0000
Subject: [PATCH 2/2] Added test for errorlog mode setting

---
 tests/basic/errorlog_permission.phpt | 38 ++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 tests/basic/errorlog_permission.phpt

diff --git a/tests/basic/errorlog_permission.phpt b/tests/basic/errorlog_permission.phpt
new file mode 100644
index 0000000000000..e49c19317621e
--- /dev/null
+++ b/tests/basic/errorlog_permission.phpt
@@ -0,0 +1,38 @@
+--TEST--
+Check permissions for created errorlog file
+--SKIPIF--
+<?php 
+if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
+    die("skip this test on windows");
+}
+?>
+--INI--
+error_log=error_permissions_test.log
+error_log_mode=0600
+--FILE--
+<?php
+
+const LOG_FILENAME='error_permissions_test.log';
+
+try {
+    if (file_exists(LOG_FILENAME)) {
+        unlink(LOG_FILENAME);
+    }
+    $oldMask = umask(0000);
+
+    error_log("hello world");
+
+    assert(file_exists(LOG_FILENAME));
+
+    printf("got permissions=%o\n", fileperms(LOG_FILENAME) & 0777);
+    printf("errorlog contents\n%s", file_get_contents(LOG_FILENAME));
+    
+    umask($oldMask);
+} finally {
+    unlink(LOG_FILENAME);
+}
+?>
+--EXPECTF--
+got permissions=600
+errorlog contents
+[%d-%s-%d %d:%d:%d %s] hello world