Need secure solution to get the size of a directory with PHP

Question

I have a vmail directory manage by postfix with the permissions set like this:

• user: vmail
• group: vmail
• permission 700

I need to get the size of that directory with PHP. To do this, I'm using that code:

$io = popen('/usr/bin/du -sk '.$directory, 'r');

It work pretty well for the directories manage by PHP but not with the vmail directory because of the permissions.

The best solution that come to my mind is changing the user of the vmail directory to www-data.

What I'd like to know is what you guys think of this solution and if you think to a better solution to do it without reducing the security ?

Answer 1

I would not recommend to call a command like du directly from PHP. The problem is that its execution might take many minutes, and before it finishes your php's execution_timeout or some timeouts of the webserver might be reached.

I would rather recommend to do this in some kind of asynchronous way. Like for example having a nightly cronjob, which could run as any privileged user, executing the du and writing the result into a file. Then the PHP would only read this file when it needs to know the size.

Of course, that way the number can be up to 24 hours out of date. But at least you can be sure that your PHP will execute fast, and doesn't make any of the workers wait for a slow du.