AppArmor kills apache2 when in aa-complain mode, why is there a mysqld.sock failure?

Question

I'm running Ubuntu 18.04.1 LTS

I'm trying to create an apache2 profile in AppArmor but when I run aa-genprof and try to hit my Drupal website to scan in processes for the profile my website breaks while the profile is scanning in complain mode. Here is the syslog line that is thrown:

Dec 29 07:21:41 ip-172-31-9-2 kernel: [225623.487271] audit: type=1400 audit(1546068101.318:6846): apparmor="ALLOWED" operation="connect" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/apache2" name="run/mysqld/mysqld.sock" pid=30086 comm="apache2" requested_mask="wr" denied_mask="wr" fsuid=33 ouid=106

Here is the user.sbin.apache2 AppArmor config that aa-genprof created

# Last Modified: Sat Dec 29 03:30:28 2018
#include 

/usr/sbin/apache2 flags=(attach_disconnected,complain) {
  #include 
  #include 
  #include 

  ^DEFAULT_URI flags=(complain) {
  }

  ^HANDLING_UNTRUSTED_INPUT flags=(complain) {
  }
}

To get the webserver back I have to disable the apache2 profile...I've tried correcting the apparmore apache2 profile with aa-logprof but that does not work. If you have a working apache2 config for Ubuntu 18.04.1 LTS please share it. Thanks.

Answer 1

You'll need to install Apache's own AppArmor module and then update the supplied profile.

Install the apache module

apt-get install libapache2-mod-apparmor

Enable the module

a2enmod apparmor

Restart Apache to pick up the new module

systemctl restart apache2

Put the new profile into complain mode

aa-complain /etc/apparmor.d/usr.sbin.apache2

Pick up the new AppArmor settings

systemctl restart apache2

Generate your custom profile

aa-logprof