AppArmor genprof problem for apache2 on Ubuntu 18

Question

I am unable to create a proper AppArmor profile for apache2 on Ubuntu 18.

When I follow these steps, I am unable to scan and build a profile for apache2 because my website fails during the genprof procedure as follows:

Note: before I do anything I stop apache with "service apache2 stop"

The only way I can get my website back is to disable the profile as follows:

sudo ln -s /etc/apparmor.d/usr.sbin.apache2 /etc/apparmor.d/disable/

sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.apache2

I've removed the disable sym link and the apparmor apache2 config many times and tried to rerun aa-genprof many times but it fails every time.

I've also tried to put apache2 in aa-complain mode and tried aa-logprof too. I can't seem to get any apache apparmor logs to go to the syslog...

What do you recommend I do. I want to use aa-genprof to help me build an apparmor config for apache2.

Aravind · Accepted Answer · 2019-05-11 16:20:38Z

You dont need to aa-genprof apache2. Apparmor profile is avalible as libapache2-mod-apparmor. Please follow the below github document.

1) You need apache2 profile libapache2-mod-apparmor.

apt install libapache2-mod-apparmor

2) Enable it

aa-enforce /etc/apparmor.d/usr.sbin.apache2

If you are getting error like aa-enforce not found. int apparmor-utils

apt-get install apparmor-utils

3) To configure your appache, I followed the below:

a2enmod mpm_prefork
a2enmod apparmor
service apache2 restart

You can find my old answer in server fault:

1 Answer 1