Arch Linux

Please read this before reporting a bug:

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#62783 - [security] [php] add apparmor support to extra/php-fpm and extra/php

Attached to Project: Arch Linux
Opened by Boris "Hundi Wam Wam" Digital (boris64) - Friday, 31 May 2019, 12:20 GMT
Last edited by freswa (frederik) - Saturday, 22 February 2020, 22:03 GMT
Task Type Feature Request
Category Security
Status Assigned
Assigned To Pierre Schmitz (Pierre)
Levente Polyak (anthraxx)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 0%
Votes 2
Private No


The php-fpm-package in Archlinux seems to be build w/o proper apparmor (changehat) support.
This feature seems to be enabled in php/php-fpm only when running ./configure on a host with apparmor installed (or maybe there's a config parameter i didn't see?).

After rebuilding and installing php/php-fpm using the standard PKGBUILD (taken from on my build-vm (with the package 'apparmor' installed) the feature is enabled and working fine.

This is a really cool security feature (for auditing/locking up webapps) which is already built in php/php-fpm and could be imho enabled at no extra cost, but somehow (are there reaons?) it got disabled in Arch.

-> Please add support for apparmor/changehat in php/php-fpm

Additional info:
* package version(s)

* config and/or log files etc.

* link to upstream bug report, if any

Steps to reproduce:
1) Add a parameter 'apparmor_hat = $my_php-fpm_pool_here' in a
configfile like /etc/php/php-fpm.conf/www.conf.

2) Run config check via php-fpm
# php-fpm --test --fpm-config /etc/php/php-fpm.conf/www.conf
[31-May-2019 13:55:53] ERROR: [www.conf:6] unknown entry 'apparmor_hat'
[31-May-2019 13:55:53] ERROR: failed to load configuration file 'www.conf'
[31-May-2019 13:55:53] ERROR: FPM initialization failed
This task depends upon

Comment by Boris "Hundi Wam Wam" Digital (boris64) - Thursday, 11 November 2021, 11:33 GMT
I really hate to bump a bug report (sorry!), but is this somehow considered to be enabled? I'd really like to switch my webserver back to arch (from debian), but apparmor is mandatory to me. This really should be easy to implement with no(?) kind of disadvantage.

Thank you in adavance.