From 39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2 Mon Sep 17 00:00:00 2001
From: Lukasz Kasprzak <lukasz.kasprzak@pm.me>
Date: Fri, 20 Mar 2026 19:16:32 +0100
Subject: feat: first fully successful run e2e on straper

---
 .../apparmor.d/abstractions/apache2-common         | 43 ++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 straper/db/public/apparmor/apparmor.d/abstractions/apache2-common

(limited to 'straper/db/public/apparmor/apparmor.d/abstractions/apache2-common')

diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common b/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common
new file mode 100644
index 0000000..0982635
--- /dev/null
+++ b/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common
@@ -0,0 +1,43 @@
+# vim:syntax=apparmor
+
+# This file contains basic permissions for Apache and every vHost
+
+  abi <abi/4.0>,
+
+  include <abstractions/nameservice>
+
+  # Allow other processes to read our /proc entries
+  ptrace (readby),
+  # Allow other processes to trace us by default
+  ptrace (tracedby),
+  # Allow unconfined processes to send us signals by default
+  signal (receive) peer=unconfined,
+  # Allow apache to send us signals by default
+  signal (receive) peer=apache2,
+  # Allow other hats to signal by default
+  signal peer=apache2//*,
+  # Allow us to signal ourselves
+  signal peer=@{profile_name},
+
+  # Apache
+  network inet stream,
+  network inet6 stream,
+  # apache manual, error pages and icons
+  /usr/share/apache2/** r,
+
+  # changehat itself
+  @{PROC}/@{pid}/attr/{apparmor/,}current                        rw,
+
+  # htaccess files - for what ever it is worth
+  /**/.htaccess            r,
+
+  /dev/urandom            r,
+
+  # sasl-auth
+  @{run}/saslauthd/mux rw,
+
+  # OCSP stapling
+  @{run}/lock/apache2/stapling-cache* rw,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/apache2-common.d>
-- 
cgit v1.3