Running apache2 on Ubuntu 12.04, using mod-apparmor for change-hat support.
I have installed and verified that change-hat is working but that it is not working for externally included hats like the example hat provided for phpSysInfo
by the mod-apparmor
package.
I'm curious why this particular external include doesn't work, when other types of includes (ie: the "abstractions") are working. It's strange that the package maintainer set it up this way if it doesn't work.
The hat works fine if it is not provided as an "include", but is instead written directly into the apache2
profile.
The pertinent config file layout is like so:
/etc/
| apparmor.d/
| | apache2.d/
| | | phpsysinfo
| | usr.lib.apache2.mpm-prefork.apache2
And the hats are included in the apache profile like this, as provided by the package maintainer:
/usr/lib/apache2/mpm-prefork/apache2 flags=(complain) {
#include <apache2.d>
}
With the hat file (apache2.d/phpsysinfo
) looking like this:
^phpsysinfo {
#include <abstractions/apache2-common>
#include <abstractions/base>
...
}
0 Answers