Arch Linux

Please read this before reporting a bug:

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#62783 - [security] [php] add apparmor support to extra/php-fpm and extra/php

Attached to Project: Arch Linux
Opened by Boris "Hundi Wam Wam" Digital (boris64) - Friday, 31 May 2019, 12:20 GMT
Last edited by freswa (frederik) - Saturday, 22 February 2020, 22:03 GMT
Task Type Feature Request
Category Security
Status Assigned
Assigned To Pierre Schmitz (Pierre)
David Runge (dvzrv)
Levente Polyak (anthraxx)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 0%
Votes 3
Private No


The php-fpm-package in Archlinux seems to be build w/o proper apparmor (changehat) support.
This feature seems to be enabled in php/php-fpm only when running ./configure on a host with apparmor installed (or maybe there's a config parameter i didn't see?).

After rebuilding and installing php/php-fpm using the standard PKGBUILD (taken from on my build-vm (with the package 'apparmor' installed) the feature is enabled and working fine.

This is a really cool security feature (for auditing/locking up webapps) which is already built in php/php-fpm and could be imho enabled at no extra cost, but somehow (are there reaons?) it got disabled in Arch.

-> Please add support for apparmor/changehat in php/php-fpm

Additional info:
* package version(s)

* config and/or log files etc.

* link to upstream bug report, if any

Steps to reproduce:
1) Add a parameter 'apparmor_hat = $my_php-fpm_pool_here' in a
configfile like /etc/php/php-fpm.conf/www.conf.

2) Run config check via php-fpm
# php-fpm --test --fpm-config /etc/php/php-fpm.conf/www.conf
[31-May-2019 13:55:53] ERROR: [www.conf:6] unknown entry 'apparmor_hat'
[31-May-2019 13:55:53] ERROR: failed to load configuration file 'www.conf'
[31-May-2019 13:55:53] ERROR: FPM initialization failed
This task depends upon

Comment by Boris "Hundi Wam Wam" Digital (boris64) - Thursday, 11 November 2021, 11:33 GMT
I really hate to bump a bug report (sorry!), but is this somehow considered to be enabled? I'd really like to switch my webserver back to arch (from debian), but apparmor is mandatory to me. This really should be easy to implement with no(?) kind of disadvantage.

Thank you in adavance.
Comment by David Runge (dvzrv) - Monday, 07 November 2022, 23:31 GMT
@Pierre: We can enable this by adding `--with-fpm-apparmor` to the configure call and including apparmor in makedepends and optdepends for php-fpm.
Comment by Pierre Schmitz (Pierre) - Friday, 11 November 2022, 13:43 GMT
@David: You are correct; this got totally lost. I'll have a look at Apparmor.
Comment by Pierre Schmitz (Pierre) - Friday, 11 November 2022, 16:59 GMT
When built with apparmor support php-fpm links to which makes it a hard dpendency and not optional (which might bring in more dependencies as some might like). I guess I could provide a separate php-fpm-apparmor (split) package. What do you think?
Comment by David Runge (dvzrv) - Tuesday, 22 November 2022, 11:53 GMT
@Pierre have you tried whether it runs without apparmor installed? Is it still configurable?
Comment by Pierre Schmitz (Pierre) - Wednesday, 14 December 2022, 10:32 GMT
It does link against libapparmor, so the binary wont even run if that is not present. According to the documentation php-fpm would still work with apparomor being disabled even if it was linked against its library.

Another solution would be to introduce a split libappromor package.