With apologies for bumping this topic, I think it’s relevant to add my experience for others who may encounter this.
I had a frustrating experience trying to solve open_basedir problems. I’m completely new to Concrete, and every time I experienced an error I had to go and delete the database in order to restart the install and try a new solution. I eventually figured out that my hosting provider had configured a random, unusable “session.save_path” folder in php settings. The solution was to identify (as @nickratering did) a folder above web root and put that into a concrete.php file as described. In my case my web root is at /home/[xxx]/example.com/private_html/ and I have selected to use /home/[xxx]/tmp as my session.save_path.
For reference, the error I was getting was
is_dir(): open_basedir restriction in effect. File(/opt/alt/php74/var/lib/php/session) is not within the allowed path(s): (/home/[xxx]/:/tmp:/var/tmp:/opt/alt/php81/usr/share/pear/:/dev/urandom:/usr/local/lib/php/:/usr/local/php81/lib/php/).
My hosting provider had set session.save_path to /opt/alt/php74/var/lib/php/session but despite me trying to use their hosting panel to add that folder to the open_basedir php variable (so that the webserver has permission to run, it didn’t seem to solve the problem. Much better to use a folder within my home directory for this rather than a global folder, I guess.
BTW, I first developed insight into this problem by setting session.save_path to a folder I didn’t have permission to write in, and my error changed from an open_basedir one to a write permission error.
I note that in this post another user solved the open_basedir error by using their hosting control panel to change the session (“upload_tmp_dir”) folder location - although I think that solution encounters the security issue mentioned above, that it puts tmp files into publicly accessible folders (in WEBSPACEROOT). Request failed: unable to verify support for request URLs - Installation - Concrete CMS
I’m not sure how common this open_basedir install issue is, but I wonder if it might be worth putting it into the install test page or into the install instructions.