apache2 does not work with shipped profiles
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
AppArmor |
Fix Released
|
Medium
|
Unassigned | ||
apparmor (Ubuntu) |
Fix Released
|
Medium
|
Unassigned |
Bug Description
Apache2 fails dramatically with apparmor module enabled.
$ apt-get install apache2 libapache2-mod-php5 libapache2-
#bug?
# Processing triggers for ufw (0.34~rc-0ubuntu2) ...
# WARN: Skipping 'ufw-directorys
$ service apache2 stop
$ service apache2 start
# All is well
# By default, apache2 is disabled:
$ aa-status | grep apache | wc -l
0
$ ls /etc/apparmor.
1
$ grep complain /etc/apparmor.
/usr/sbin/apache2 flags=(complain) {
^DEFAULT_URI flags=(complain) {
^HANDLING_
$ aa-enforce /etc/apparmor.
$ ls /etc/apparmor.
0
$ grep complain /etc/apparmor.
^DEFAULT_URI flags=(complain) {
^HANDLING_
#bug: complain not removed on hats when aa-enforce runs
$ aa-status
...
31 profiles are in enforce mode.
...
/usr/
...
2 profiles are in complain mode.
/usr/
/usr/
6 processes are unconfined but have a profile defined.
/usr/
/usr/
...
$ service apache2 stop
* Stopping web server apache2
$ ps -ef | grep apache2 | wc -l
8
#bug: stop fails, via seemingly impossible signal blocking
# dmesg shows:
# [17967.520600] type=1400 audit(139957797
# How did this happen? The "/usr/sbin/apache2" profile has "base", which includes the signal
# rules for allowing an unconfined process send to it.
# Get back to sanity:
$ apparmor_parser -R /etc/apparmor.
$ service apache2 stop
$ vi /etc/apparmor.
$ apparmor_parser -r /etc/apparmor.
$ aa-status
...
33 profiles are in enforce mode.
...
/usr/
/usr/
/usr/
...
$ service apache2 start
$ aa-status
...
13 processes are in enforce mode.
...
/usr/
/usr/
...
$ wget http://
# All is well
$ a2enmod apparmor
$ service apache2 restart
$ aa-status
...
13 processes are in enforce mode.
...
/usr/
/usr/
/usr/
...
$ wget http://
# All is well
$ service apache2 stop
# Apache2 can't shut down
# logs: [Fri May 09 22:34:42.280997 2014] [core:warn] [pid 1162] AH00045: child process 1165 still did not exit, sending a SIGTERM
# dmesg: [140073.881409] type=1400 audit(139970008
#bug: signals from apache to hats fail
$ pkill apache2
pkill: killing pid 1382 failed: Permission denied
pkill: killing pid 1383 failed: Permission denied
...
#bug: signals from unconfined to hats fail
# Fix things up...
$ apparmor_parser -R /etc/apparmor.
$ service apache2 stop
$ pkill apache2
$ vi /etc/apparmor.
# add to ^HANDLING_
# # Allow unconfined processes to send us signals by default
# signal (receive) peer=unconfined,
# # Allow apache to send us signals by default
# signal (receive) peer=/usr/
# # Allow us to signal ourselves
# signal peer=@{
# add to ^DEFAULT_URI (not in "base"):
# # Allow apache to send us signals by default
# signal (receive) peer=/usr/
# add to /usr/sbin/apache2:
# # Send signals to all hats.
# signal (send) peer=/usr/
# add to /etc/apparmor.
# # Allow unconfined processes to send us signals by default
# signal (receive) peer=unconfined,
# # Allow apache to send us signals by default
# signal (receive) peer=/usr/
# # Allow us to signal ourselves
# signal peer=@{
$ apparmor_parser -r /etc/apparmor.
$ service apache2 start
$ aa-status
...
13 processes are in enforce mode.
...
/usr/
/usr/
/usr/
...
$ wget http://
$ service apache2 stop
$ service apache2 start
# All is well
# Create new "site-one" hat via /etc/apparmor.
# ^site-one {
# #include <abstractions/
# }
# Attach it to /etc/apache2/
# in VirtualHost...
# <IfModule mod_apparmor.c>
# AADefaultHatName site-one
# </IfModule>
$ apparmor_parser -r /etc/apparmor.
$ service apache2 reload
$ wget http://
#fails, expected, however, in dmesg:
# [141351.407572] type=1400 audit(139970135
#bug: attr/current "r" missing in apache2-common
$ vi /etc/apparmor.
# add 'r" to attr/current
$ apparmor_parser -r /etc/apparmor.
$ wget http://
#fails, expected. dmesg looks sensible
# All is well
# Add to site-one:
# # Site files.
# /var/www/** r,
# # Logs.
# /var/log/apache2/** w,
$ apparmor_parser -r /etc/apparmor.
$ wget http://
# All is well
# Notes:
# - HANDLING_
# DEFAULT_URI should include apache2-common and basics for default site
# instead of full permissions.
Related branches
tags: | added: patch |
Changed in apparmor (Ubuntu): | |
importance: | Undecided → Medium |
status: | New → Triaged |
tags: | added: aa-policy |
Changed in apparmor (Ubuntu): | |
status: | Triaged → Fix Released |
Changed in apparmor: | |
status: | In Progress → Fix Committed |
The "wordpress" package also needs the mysql abstraction added to its profile...