Tag: profile

I’m using PHP-FPM with Apache2 on my server, as PHP-FPM doesn’t run as Apache2 module, I figured it would need a profile for it.

This is my first time working with AppArmor, so I’m afraid of crashing the server or leaving everything open for attack.

Using log analysis and some existing examples, I managed to create this profile.

/etc/apparmor.d/usr.sbin.apache2

profile apache2 /usr/{bin,sbin}/apache2 flags=(attach_disconnected, complain) {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <apache2.d>
  #include <local/usr.sbin.apache2>

  capability dac_override,
  capability kill,
  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability sys_tty_config,

  signal send peer=@{profile_name}//*,

  /etc/apache2/** r,
  /etc/gai.conf r,
  /etc/group r,
  /etc/mime.types r,
  /run/apache2/** rw,
  /run/lock/apache2/** rw,
  /usr/sbin/apache2 mr,
  /var/log/apache2/** rw,
  /var/www/html/** r,
  /run/php/php7.4-fpm.sock rw,


  ^DEFAULT_URI flags=(attach_disconnected, complain) {
    #include <abstractions/apache2-common>
    #include <abstractions/base>

    /etc/apache2/** r,
    /etc/gai.conf r,
    /etc/group r,
    /etc/mime.types r,
    /run/apache2/** rw,
    /run/lock/apache2/** rw,
    /usr/sbin/apache2 mr,
    /var/log/apache2/** rw,
    /var/www/html/** r,

  }

  ^HANDLING_UNTRUSTED_INPUT flags=(attach_disconnected, complain) {
    #include <abstractions/apache2-common>

    /etc/apache2/** r,
    /etc/gai.conf r,
    /etc/group r,
    /etc/mime.types r,
    /run/apache2/** rw,
    /run/lock/apache2/** rw,
    /usr/sbin/apache2 mr,
    /var/log/apache2/** rw,
    /var/www/html/** r,

  }
}

/etc/apparmor.d/usr.sbin.php-fpm7.4

#include <tunables/global>

/usr/sbin/php-fpm7.4 flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/php>

  capability kill,

  /run/php/php7.4-fpm.sock w,
  /tmp** rw,
  /usr/sbin/php-fpm7.4 mr,
  /var/www/html/** r,
  /run/php/php7.4-fpm.pid w,
  /run/systemd/notify w,

}

My fear arose because AppArmor had also set the permission to use /run/systemd/notify w, as owner /run/systemd/notify w, something I thought was not correct.

Is this profile secure or does it open loopholes for intruders?