How to set permissions when executing an external program from under Apache?

Question

PHP

Hello. I'm just getting started, so my questions may seem simple. But I've been struggling with this problem for a few days now and have come to a dead end.
In short, the problem is that an external program called from a php script does not work the same as if it is called from the console via ssh, moreover, the execution occurs under the same user.
From the console via ssh I go from under myusername (not root) and execute:

$cd /var/www/myusername/data/www/mysitename/tmp
/var/www/myusername/data/www/mysitename/tmp$ /usr/bin/pdflatex myfile.tex

And everything works fine, a pdf file appears in the tmp folder.
But if I call the same command from a PHP script:

$pipes = array();
$options = array();
$cmd = '/usr/bin/pdflatex myfile.tex';
$cwd = '/var/www/myusername/data/www/mysitename/tmp';
proc_open( $cmd, $options, $pipes, $cwd );

or from a CGI script:

#!/bin/sh
echo Content-type: text/html
echo
cd /var/www/myusername/data/www/mysitename/tmp
/usr/bin/pdflatex myfile.tex

then in the tmp folder, the pdflatex program will create a log file with a description of the errors. Errors are related to unavailability of some font files. Moreover, the created files have myusername in the owner's attributes. This means that PHP and the pdflatex called by it are executed from under myusername. Moreover, if Cyrillic packages are not used in the myfile.tex file, then everything works fine both from PHP and from CGI. So the problem is that the pdflatex program cannot get or generate temporary files with fonts.
What could be causing the difference? What permission restrictions does execution through Apache give? And most importantly, how to fix it? At least in what direction to look? I'm afraid that I won't be able to solve the problem for a very long time if I study all the documentation.
Just in case, I will say that the OS is Debian7, and pdflatex is a program from the texlive package, which is designed to work with LaTeX.

Answer 1

The script is executed with apache rights. That is, if your apache is running from the wwwroot user or the like, then the scripts are run from the same user.
Give more rights to this user. Just keep in mind that anyone else who visits your site, for example, a potential pest, will be able to get the same rights.

Answer 2

1. try to run Apache with fastCGI, in this case you can set both the user and the group for each site, without any special keys, and don't forget to add it to group 0, which is not really feng shui.
2. option use non-standard file permissions, in particular
linuxsoid.com/blog/standartnye_prava_unix_suid_sgi...
read immediately about
SUID, SGID and Sticky Bits

Answer 3

So the problem is that the pdflatex program cannot get or generate temporary files with fonts.

Yes.
When you simply generate a pdf file from the console, the $HOME/.texmf-var.