Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Running apache2 on Ubuntu 12.04, using mod-apparmor for change-hat support.

I have installed and verified that change-hat is working but that it is not working for externally included hats like the example hat provided for phpSysInfo by the mod-apparmor package.

I'm curious why this particular external include doesn't work, when other types of includes (ie: the "abstractions") are working. It's strange that the package maintainer set it up this way if it doesn't work.

The hat works fine if it is not provided as an "include", but is instead written directly into the apache2 profile.

The pertinent config file layout is like so:

| apparmor.d/
| | apache2.d/
| | | phpsysinfo
| | usr.lib.apache2.mpm-prefork.apache2

And the hats are included in the apache profile like this, as provided by the package maintainer:

/usr/lib/apache2/mpm-prefork/apache2 flags=(complain) {
  #include <apache2.d>

With the hat file (apache2.d/phpsysinfo) looking like this:

^phpsysinfo {
  #include <abstractions/apache2-common>
  #include <abstractions/base>
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.