Quantcast
Channel: Bountied questions - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 154

AppArmor Not Recognizing Files & Directories That Exist (Syntax Error)

$
0
0

I am on Ubuntu 20.04 server running AppArmor 2.13.3 and I have downloaded two additional apparmor profiles, from the [official apparmor repository][1]:

usr.sbin.apache2php-fpm

Because I am running such an older version of apparmor (the only one available from my repository) I had to do three things in order to get the profiles / apparmor itself working:

Things I did:

  1. I hashed out #abi <abi/3.0>, in both profiles

  2. In /etc/apparmor.d/php-fpm I replaced the clauses using the run variables as follows:

    #we need to be able to create all sockets#@{run}/php{,-fpm}/php*-fpm.pid rw,#@{run}/php{,-fpm}/php*-fpm.sock rwlk,#DP Edits: New socket creation w/o run variable    /{var/,}run/php{,-fpm}/php*-fpm.pid rw,    /{var/,}run/php{,-fpm}/php*-fpm.sock rwlk,  
  3. I hashed out line 68 in /etc/apparmor.d/php-fpm and line 117 in /etc/apparmor.d/usr.sbin.apache2... This was necessary to resolve the following errors:

    root@test:/etc/apparmor.d# apparmor_parser -r /etc/apparmor.d/usr.sbin.apache2     ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/php-fpm line 68:        include if exists <php-fpm.d>  include if exists <local/php-fpm> }    ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/usr.sbin.apache2 line 117:        include if exists <local/usr.sbin.apache2> }

Question/Problem:
How do I adjust the syntax of line 68 in /etc/apparmor.d/php-fpm, so that it is compatible with my version of apparmor (2.13.3)? Or is there a different problem causing the errors above that I don't understand?

Lines that I hashed out:line 68 in /etc/apparmor.d/php-fpm

#load all files from this directory  #store your configurations per pool in this dir#include if exists <php-fpm.d>   <--hashed out by me  #Site-specific additions and overrides. See local/README for details.#include if exists <local/php-fpm>   <--hashed out by me

Note: the directory php-fpm.d and file local/php-fpm (empty) both exist.

FYI

line 117 in /etc/apparmor.d/usr.sbin.apache2

#Site-specific additions and overrides. See local/README for details.#include if exists <local/usr.sbin.apache2>

Overall, I haven't noticed any problems being created by the profiles following my edits, but I run a Virtualmin control and will likely need to php-fpm child profiles.


Viewing all articles
Browse latest Browse all 154

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>