5

Running apache2 on Ubuntu 12.04, using mod-apparmor for change-hat support.

I have installed and verified that change-hat is working but that it is not working for externally included hats like the example hat provided for phpSysInfo by the mod-apparmor package.

I'm curious why this particular external include doesn't work, when other types of includes (ie: the "abstractions") are working. It's strange that the package maintainer set it up this way if it doesn't work.

The hat works fine if it is not provided as an "include", but is instead written directly into the apache2 profile.

The pertinent config file layout is like so:

/etc/
| apparmor.d/
| | apache2.d/
| | | phpsysinfo
| | usr.lib.apache2.mpm-prefork.apache2

And the hats are included in the apache profile like this, as provided by the package maintainer:

/usr/lib/apache2/mpm-prefork/apache2 flags=(complain) {
  #include <apache2.d>
}

With the hat file (apache2.d/phpsysinfo) looking like this:

^phpsysinfo {
  #include <abstractions/apache2-common>
  #include <abstractions/base>
  ...
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.