apparmor/profiles/apparmor.d/abstractions/apache2-common

# vim:syntax=apparmor

# This file contains basic permissions for Apache and every vHost

  #include <abstractions/nameservice>

  # Apache
  network inet stream,
  network inet6 stream,
  # apache manual, error pages and icons
  /usr/share/apache2/** r,

  # changehat itself
  @{PROC}/@{pid}/attr/current                        w,

  # htaccess files - for what ever it is worth
  /**/.htaccess            r,

  /dev/urandom            r,
update php5 abstraction, add more details to apache hat documentation, include a common apache2 abstraction for use with hats 2010-01-03 13:16:38 -08:00			`# vim:syntax=apparmor`

Split off various permissions from the httpd2-prefork profile to abstractions/apache2-common. Additionally, add read permissions for //.htaccess and /dev/urandom to apache2-common. The patch is based on a profile abstraction from darix. I made some things more strict (compared to darix' profile), and OTOH added some things that are needed on my servers. * BACKWARDS-INCOMPATIBLE CHANGES *** ^HANDLING_UNTRUSTED_INPUT - don't allow /.htaccess (.htaccess files in subdirectories are still allowed) - don't allow .htaccess files (the old /*.htaccess rule was too generous) 2012-01-05 23:28:17 +01:00			`# This file contains basic permissions for Apache and every vHost`

			`#include <abstractions/nameservice>`

update php5 abstraction, add more details to apache hat documentation, include a common apache2 abstraction for use with hats 2010-01-03 13:16:38 -08:00			`# Apache`
			`network inet stream,`
Split off various permissions from the httpd2-prefork profile to abstractions/apache2-common. Additionally, add read permissions for //.htaccess and /dev/urandom to apache2-common. The patch is based on a profile abstraction from darix. I made some things more strict (compared to darix' profile), and OTOH added some things that are needed on my servers. * BACKWARDS-INCOMPATIBLE CHANGES *** ^HANDLING_UNTRUSTED_INPUT - don't allow /.htaccess (.htaccess files in subdirectories are still allowed) - don't allow .htaccess files (the old /*.htaccess rule was too generous) 2012-01-05 23:28:17 +01:00			`network inet6 stream,`
			`# apache manual, error pages and icons`
update php5 abstraction, add more details to apache hat documentation, include a common apache2 abstraction for use with hats 2010-01-03 13:16:38 -08:00			`/usr/share/apache2/** r,`

			`# changehat itself`
Subject: profiles - use @{pid} tunable This patch adds the kernelvars tunable to the global set that is usually included by default in apparmor policies. It then converts the rules that are intended to match /proc/pid to use this tunable. Signed-off-by: Steve Beattie <sbeattie@ubuntu.com> Acked-By: Seth Arnold <seth.arnold@canonical.com> 2013-01-02 15:34:38 -08:00			`@{PROC}/@{pid}/attr/current w,`
update php5 abstraction, add more details to apache hat documentation, include a common apache2 abstraction for use with hats 2010-01-03 13:16:38 -08:00
Split off various permissions from the httpd2-prefork profile to abstractions/apache2-common. Additionally, add read permissions for //.htaccess and /dev/urandom to apache2-common. The patch is based on a profile abstraction from darix. I made some things more strict (compared to darix' profile), and OTOH added some things that are needed on my servers. * BACKWARDS-INCOMPATIBLE CHANGES *** ^HANDLING_UNTRUSTED_INPUT - don't allow /.htaccess (.htaccess files in subdirectories are still allowed) - don't allow .htaccess files (the old /*.htaccess rule was too generous) 2012-01-05 23:28:17 +01:00			`# htaccess files - for what ever it is worth`
			`/**/.htaccess r,`

			`/dev/urandom r,`