I am on Ubuntu 20.04 server running AppArmor 2.13.3 and I have downloaded two additional apparmor profiles, from the [official apparmor repository][1]:
usr.sbin.apache2php-fpm
Because I am running such an older version of apparmor (the only one available from my repository) I had to do three things in order to get the profiles / apparmor itself working:
Things I did:
I hashed out
#abi <abi/3.0>,
in both profilesIn
/etc/apparmor.d/php-fpm
I replaced the clauses using the run variables as follows:#we need to be able to create all sockets#@{run}/php{,-fpm}/php*-fpm.pid rw,#@{run}/php{,-fpm}/php*-fpm.sock rwlk,#DP Edits: New socket creation w/o run variable /{var/,}run/php{,-fpm}/php*-fpm.pid rw, /{var/,}run/php{,-fpm}/php*-fpm.sock rwlk,
I hashed out line 68 in
/etc/apparmor.d/php-fpm
and line 117 in/etc/apparmor.d/usr.sbin.apache2
... This was necessary to resolve the following errors:
root@test:/etc/apparmor.d# apparmor_parser -r /etc/apparmor.d/usr.sbin.apache2 ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/php-fpm line 68: include if exists <php-fpm.d> include if exists <local/php-fpm> } ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/usr.sbin.apache2 line 117: include if exists <local/usr.sbin.apache2> }
Question/Problem:
How do I adjust the syntax of line 68 in /etc/apparmor.d/php-fpm
, so that it is compatible with my version of apparmor (2.13.3)? Or is there a different problem causing the errors above that I don't understand?
Lines that I hashed out:line 68 in /etc/apparmor.d/php-fpm
#load all files from this directory #store your configurations per pool in this dir#include if exists <php-fpm.d> <--hashed out by me #Site-specific additions and overrides. See local/README for details.#include if exists <local/php-fpm> <--hashed out by me
Note: the directory php-fpm.d
and file local/php-fpm
(empty) both exist.
FYI
line 117 in /etc/apparmor.d/usr.sbin.apache2
#Site-specific additions and overrides. See local/README for details.#include if exists <local/usr.sbin.apache2>
Overall, I haven't noticed any problems being created by the profiles following my edits, but I run a Virtualmin control and will likely need to php-fpm child profiles.