0

I am unable to create a proper AppArmor profile for apache2 on Ubuntu 18.

When I follow these steps, I am unable to scan and build a profile for apache2 because my website fails during the genprof procedure as follows:

Note: before I do anything I stop apache with "service apache2 stop"

  1. I run aa-genprof apache2

  2. I get the message to start my service and scan

  3. I then "service apache2 start" in another terminal.

  4. I then try to hit my drupal website and it fails with a "filelock" error.

The only way I can get my website back is to disable the profile as follows:

sudo ln -s /etc/apparmor.d/usr.sbin.apache2 /etc/apparmor.d/disable/

sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.apache2

I've removed the disable sym link and the apparmor apache2 config many times and tried to rerun aa-genprof many times but it fails every time.

I've also tried to put apache2 in aa-complain mode and tried aa-logprof too. I can't seem to get any apache apparmor logs to go to the syslog...

What do you recommend I do. I want to use aa-genprof to help me build an apparmor config for apache2.

0

You dont need to aa-genprof apache2. Apparmor profile is avalible as libapache2-mod-apparmor. Please follow the below github document.

git hub document

1) You need apache2 profile libapache2-mod-apparmor.

apt install libapache2-mod-apparmor

2) Enable it

aa-enforce /etc/apparmor.d/usr.sbin.apache2

If you are getting error like aa-enforce not found. int apparmor-utils

apt-get install apparmor-utils

3) To configure your appache, I followed the below:

a2enmod mpm_prefork
a2enmod apparmor
service apache2 restart

You can find my old answer in server fault:

https://serverfault.com/questions/932410/enabling-apparmor-for-apache2-in-ubuntu-18-04

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.