Add apparmor_hat support to php::fpm::pool

[simondeziel]

Pull Request (PR) description

Add support for apparmor_hat directive. This allows a php-fpm binary contained by an Apparmor profile to switch to a more specific profile (hat in apparmor parlance) tailored to the FPM pool serving the request.

Here is an example of Apparmor profile including a hat called 'foo' for the pool serving a WordPress instance:

# Author: Simon Deziel
# vim:syntax=apparmor
#include <tunables/global>

/usr/sbin/php-fpm7.2 {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/php>

  capability chown,
  capability dac_override,
  capability kill,
  capability setuid,
  capability setgid,
  capability sys_chroot,

  # slowlog
  capability sys_ptrace,
  ptrace (trace) peer=/usr/sbin/php-fpm7.2//*,

  /etc/php/7.2/fpm/php-fpm.conf  r,
  /etc/php/7.2/fpm/pool.d/*.conf r,
  /etc/ssl/openssl.cnf r,
  /usr/sbin/php-fpm7.2 rmix,

  owner /var/log/php7.2-fpm.log w,
  owner /var/log/php-fpm/*.log.slow rw,
  /run/php/php7.2-fpm.pid w,
  /run/systemd/notify w,

  # Unix sockets
  /run/php/*.sock rw,

  # XXX: weird that php7.2-fpm tests writing to /
  deny / rw,

  # aa_change_hat
  @{PROC}/@{pids}/attr/current rw,
  signal (send) set=(cont,quit,kill,term) peer=/usr/sbin/php-fpm7.2//*,
  change_profile /usr/sbin/php-fpm7.2 -> /usr/sbin/php-fpm7.2//*,
  # hats
  ^foo {
    #include <abstractions/base>
    #include <abstractions/nameservice>
    #include <abstractions/php>

    signal (receive) set=(cont,kill,quit,term) peer=/usr/sbin/php-fpm7.2,

    /usr/sbin/php-fpm7.2 mr,

    /var/log/php-fpm/foo-slow.log w,

    # Unix sockets
    /run/php/foo-fpm.sock rw,
    /run/mysqld/mysqld.sock rw,

    audit deny /var/www/foo/**.php w,
    /var/www/foo/** r,
    owner /var/www/foo/wp-content/** w,
  }
}

The php-fpm config would contain this:

# /etc/php/7.2/fpm/pool.d/foo.conf
[foo]
...
; Apparmor hat to change to
apparmor_hat = foo

Note: the above profile was tested on Ubuntu 18.04 with php-fpm from the Ubuntu repos. This version is compiled with Apparmor hat support which might not be the case for every distros.

[simondeziel]

• add data type
• unit test

[vox-pupuli-tasks]

Dear @simondeziel, thanks for the PR!

This is pccibot, your friendly Vox Pupuli GitHub Bot. I noticed that your pull request contains merge conflict. Can you please rebase?

You can find my sourcecode at voxpupuli/vox-pupuli-tasks

[bastelfreak]

thanks for the PR!

[simondeziel]

That's indeed a good addition to not permit an empty string, thanks for that and taking care of this module!