mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

profiles: adjust apache2-common abstraction for signals/mod_apparmor changes

Browse source 
Update the apache2-common abstraction so that the parent apache process
can kill worker processes inside of hats, as well as handle the updated
mod_apparmor behavior that invokes aa_change_hatv() and then checks
which hat it ended up in via aa_getconn() (which reads from
{PROC}/@{pid}/attr/current).

Author: Kees Cook <kees@ubuntu.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Bug: https://bugs.launchpad.net/apparmor/+bug/1322764
This commit is contained in:
Kees Cook 2014-06-12 16:14:08 -07:00 • committed by Steve Beattie
parent 6e127a5deb
commit c1e06843eb
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
profiles/apparmor.d/abstractions/apache2-common
View file

@ -4,6 +4,11 @@
#include <abstractions/nameservice>
# Allow apache to send us signals by default
signal (receive) peer=/usr/sbin/apache2,
# Allow us to signal ourselves
signal peer=@{profile_name},
# Apache
network inet stream,
network inet6 stream,
@ -11,7 +16,7 @@
/usr/share/apache2/** r,
# changehat itself
@{PROC}/@{pid}/attr/current w,
@{PROC}/@{pid}/attr/current rw,
# htaccess files - for what ever it is worth
/**/.htaccess r,