Skip to content

Commit

Permalink
Update apparmor doc
Browse files Browse the repository at this point in the history
  • Loading branch information
eldy committed Feb 14, 2024
1 parent 85e157f commit 18d6bd5
Show file tree
Hide file tree
Showing 2 changed files with 37 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -2792,7 +2792,13 @@ Sometimes, a reboot of server may be required to take into account any change on

All the disabled profiles are visible into */etc/apparmor.d/disable*

The log are visible into */var/log/kern.log* or */var/log/audit/audit.log*. You can use *aa-logprof* to know the log file used and convert its content into real rules into existing profiles.
The log are visible into */var/log/kern.log* or */var/log/audit/audit.log*.
To solve a problem of permission, you can use
[source,bash]
---------------
aa-logprof
---------------
Then execut the failed command or access and answer S to update the profile.


* Note: From Ubuntu 20.04+, to unload ALL apparmor profiles and reload them:
Expand Down
30 changes: 30 additions & 0 deletions etc/apparmor.d/usr.sbin.apache2
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
# Last Modified: Wed Feb 14 17:45:54 2024
#include <tunables/global>

# Author: Marc Deslauriers <[email protected]>


profile apache2 /usr/{bin,sbin}/apache2 flags=(attach_disconnected) {
#include <abstractions/base>
#include <abstractions/nameservice>
#include <apache2.d>
#include <local/usr.sbin.apache2>

capability chown,
capability dac_override,
capability dac_read_search,
capability kill,
capability net_bind_service,
capability setgid,
capability setuid,
capability sys_admin,
capability sys_tty_config,

signal send peer=@{profile_name}//*,
signal send set=term peer=unconfined,
signal send set=usr1 peer=unconfined,

/ rw,
/** mrwlkix,

}

0 comments on commit 18d6bd5

Please sign in to comment.