AppArmor kills apache2 when in aa-complain mode, why is there a mysqld.sock failure?
I'm running Ubuntu 18.04.1 LTS
I'm trying to create an apache2 profile in AppArmor but when I run aa-genprof and try to hit my Drupal website to scan in processes for the profile my website breaks while the profile is scanning in complain mode. Here is the syslog line that is thrown:
Dec 29 07:21:41 ip-172-31-9-2 kernel: [225623.487271] audit: type=1400 audit(1546068101.318:6846): apparmor="ALLOWED" operation="connect" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/apache2" name="run/mysqld/mysqld.sock" pid=30086 comm="apache2" requested_mask="wr" denied_mask="wr" fsuid=33 ouid=106
Here is the user.sbin.apache2 AppArmor config that aa-genprof created
# Last Modified: Sat Dec 29 03:30:28 2018
#include
/usr/sbin/apache2 flags=(attach_disconnected,complain) {
#include
#include
#include
^DEFAULT_URI flags=(complain) {
}
^HANDLING_UNTRUSTED_INPUT flags=(complain) {
}
}
To get the webserver back I have to disable the apache2 profile...I've tried correcting the apparmore apache2 profile with aa-logprof but that does not work. If you have a working apache2 config for Ubuntu 18.04.1 LTS please share it. Thanks.
apache2 apparmor
asked Dec 29 '18 at 14:27
uvamoodyuvamoody
12
add a comment |
I'm running Ubuntu 18.04.1 LTS
I'm trying to create an apache2 profile in AppArmor but when I run aa-genprof and try to hit my Drupal website to scan in processes for the profile my website breaks while the profile is scanning in complain mode. Here is the syslog line that is thrown:
Dec 29 07:21:41 ip-172-31-9-2 kernel: [225623.487271] audit: type=1400 audit(1546068101.318:6846): apparmor="ALLOWED" operation="connect" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/apache2" name="run/mysqld/mysqld.sock" pid=30086 comm="apache2" requested_mask="wr" denied_mask="wr" fsuid=33 ouid=106
Here is the user.sbin.apache2 AppArmor config that aa-genprof created
# Last Modified: Sat Dec 29 03:30:28 2018
#include
/usr/sbin/apache2 flags=(attach_disconnected,complain) {
#include
#include
#include
^DEFAULT_URI flags=(complain) {
}
^HANDLING_UNTRUSTED_INPUT flags=(complain) {
}
}
To get the webserver back I have to disable the apache2 profile...I've tried correcting the apparmore apache2 profile with aa-logprof but that does not work. If you have a working apache2 config for Ubuntu 18.04.1 LTS please share it. Thanks.
apache2 apparmor
asked Dec 29 '18 at 14:27
uvamoodyuvamoody
12
add a comment |
I'm running Ubuntu 18.04.1 LTS
I'm trying to create an apache2 profile in AppArmor but when I run aa-genprof and try to hit my Drupal website to scan in processes for the profile my website breaks while the profile is scanning in complain mode. Here is the syslog line that is thrown:
Dec 29 07:21:41 ip-172-31-9-2 kernel: [225623.487271] audit: type=1400 audit(1546068101.318:6846): apparmor="ALLOWED" operation="connect" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/apache2" name="run/mysqld/mysqld.sock" pid=30086 comm="apache2" requested_mask="wr" denied_mask="wr" fsuid=33 ouid=106
Here is the user.sbin.apache2 AppArmor config that aa-genprof created
# Last Modified: Sat Dec 29 03:30:28 2018
#include
/usr/sbin/apache2 flags=(attach_disconnected,complain) {
#include
#include
#include
^DEFAULT_URI flags=(complain) {
}
^HANDLING_UNTRUSTED_INPUT flags=(complain) {
}
}
To get the webserver back I have to disable the apache2 profile...I've tried correcting the apparmore apache2 profile with aa-logprof but that does not work. If you have a working apache2 config for Ubuntu 18.04.1 LTS please share it. Thanks.
apache2 apparmor
asked Dec 29 '18 at 14:27
uvamoodyuvamoody
12
I'm running Ubuntu 18.04.1 LTS
I'm trying to create an apache2 profile in AppArmor but when I run aa-genprof and try to hit my Drupal website to scan in processes for the profile my website breaks while the profile is scanning in complain mode. Here is the syslog line that is thrown:
Dec 29 07:21:41 ip-172-31-9-2 kernel: [225623.487271] audit: type=1400 audit(1546068101.318:6846): apparmor="ALLOWED" operation="connect" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/apache2" name="run/mysqld/mysqld.sock" pid=30086 comm="apache2" requested_mask="wr" denied_mask="wr" fsuid=33 ouid=106
Here is the user.sbin.apache2 AppArmor config that aa-genprof created
# Last Modified: Sat Dec 29 03:30:28 2018
#include
/usr/sbin/apache2 flags=(attach_disconnected,complain) {
#include
#include
#include
^DEFAULT_URI flags=(complain) {
}
^HANDLING_UNTRUSTED_INPUT flags=(complain) {
}
}
To get the webserver back I have to disable the apache2 profile...I've tried correcting the apparmore apache2 profile with aa-logprof but that does not work. If you have a working apache2 config for Ubuntu 18.04.1 LTS please share it. Thanks.
apache2 apparmor
apache2 apparmor
asked Dec 29 '18 at 14:27
uvamoodyuvamoody
12
asked Dec 29 '18 at 14:27
uvamoodyuvamoody
12
asked Dec 29 '18 at 14:27
uvamoodyuvamoody
12
asked Dec 29 '18 at 14:27
uvamoodyuvamoody
12
asked Dec 29 '18 at 14:27
uvamoodyuvamoody
12
12
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1105375%2fapparmor-kills-apache2-when-in-aa-complain-mode-why-is-there-a-mysqld-sock-fail%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1105375%2fapparmor-kills-apache2-when-in-aa-complain-mode-why-is-there-a-mysqld-sock-fail%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
