[apparmor] Apache2 Profile Building Failure

[Moody, David Alan (dam8u)]

Hi AppArmor Community,

I'm running Ubuntu 18.04.1 LTS

I'm trying to create an apache2 profile in AppArmor but when I run aa-genprof and try to hit my Drupal website to scan in processes for the profile my website breaks while the profile is scanning in complain mode. Here is the syslog line that is thrown:

Dec 29 07:21:41 ip-172-31-9-2 kernel: [225623.487271] audit: type=1400 audit(1546068101.318:6846): apparmor="ALLOWED" operation="connect" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/apache2" name="run/mysqld/mysqld.sock" pid=30086 comm="apache2" requested_mask="wr" denied_mask="wr" fsuid=33 ouid=106

Here is the user.sbin.apache2 AppArmor config that aa-genprof created

    # Last Modified: Sat Dec 29 03:30:28 2018
    #include <tunables/global>

    /usr/sbin/apache2 flags=(attach_disconnected,complain) {
      #include <abstractions/base>
      #include <abstractions/lxc/container-base>
      #include <abstractions/lxc/start-container>

      ^DEFAULT_URI flags=(complain) {
      }

      ^HANDLING_UNTRUSTED_INPUT flags=(complain) {
      }
    }



To get the webserver back I have to disable the apache2 profile...I've tried correcting the apparmore apache2 profile with aa-logprof but that does not work.

If you have a working apache2 config for Ubuntu 18.04.1 LTS please share it. Thanks.


NOTE: I was following the instructions given by Sean Mancini on this youtube video...it almost worked...almost!


https://www.youtube.com/watch?v=zPkrcTidwQI


****************
David Moody


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20181229/eb942801/attachment.html>