# managed by salt - do not edit!

# ------------------------------------------------------------------

#

#    Copyright (C) 2002-2005 Novell/SUSE

#    Copyright (C) 2017-2021 Christian Boltz

#

#    This program is free software; you can redistribute it and/or

#    modify it under the terms of version 2 of the GNU General Public

#    License published by the Free Software Foundation.

#

# ------------------------------------------------------------------

#include <tunables/global>

@{wiki_upload_extensions}=doc docx gif jpg jpeg odp ods odt pdf png ppt pptx svg sxc sxw xls xlsx

profile httpd2-prefork /usr/sbin/httpd{,2}-prefork flags=(complain,attach_disconnected) {

  #include <abstractions/base>

  #include <abstractions/bash>

  #include <abstractions/consoles>

  #include <abstractions/kerberosclient>

  #include <abstractions/mysql>

  #include <abstractions/nameservice>

  #include <abstractions/perl>

  #include <abstractions/php5>

  #include <abstractions/ssl_keys>

  capability dac_override,

  capability kill,

  capability net_admin,

  capability net_bind_service,

  capability setgid,

  capability setuid,

  capability sys_ptrace,

  capability sys_tty_config,

  signal send set=usr1 peer=httpd2-prefork//*,

  / rw,

  /bin/bash rix,

  /dev/random r,

  /etc/apache2/*.conf r,

  owner /etc/apache2/conf.d/ r,

  /etc/apache2/magic r,

  /etc/apache2/mod_perl-startup.pl r,

  /etc/apache2/sysconfig.d/ r,

  /etc/apache2/vhosts.d/ r,

  /etc/apache2/vhosts.d/hostings/ r,

  /etc/apache2/{conf,sysconfig,vhosts}.d/* r,

  /etc/fstab r,

  /etc/mime.types r,

  /etc/mtab r,

  /etc/odbcinst.ini r,

  /etc/php.d/** r,

  /etc/php.ini r,

  /proc/*/attr/current rw,

  /proc/meminfo r,

  /proc/sys/kernel/ngroups_max r,

  /run/httpd.pid rw,

  /tmp/magic* rw,

  /usr/apache2/error/* r,

  /usr/lib/apache2-leader/{lib,mod_}*.so* mr,

  /usr/lib/apache2-metuxmpm/{lib,mod_}*.so* mr,

  /usr/lib/apache2-prefork/{lib,mod_}*.so* mr,

  /usr/lib/apache2-worker/{lib,mod_}*.so* mr,

  /usr/lib/apache2/modules/{lib,mod_}*.so* mr,

  /usr/lib/apache2/{lib,mod_}*.so mr,

  /usr/lib/mysql/libmysql*.so* mr,

  /usr/lib64/apache2-leader/{lib,mod_}*.so* mr,

  /usr/lib64/apache2-metuxmpm/{lib,mod_}*.so* mr,

  /usr/lib64/apache2-prefork/{lib,mod_}*.so* mr,

  /usr/lib64/apache2-worker/{lib,mod_}*.so* mr,

  /usr/lib64/apache2/modules/{lib,mod_}*.so* mr,

  /usr/lib64/apache2/{lib,mod_}*.so* mr,

  /usr/lib64/mysql/libmysql*.so* mr,

  /usr/sbin/httpd{,2}-prefork mr,

  /usr/sbin/suexec2 mrix,

  /usr/share/apache2/error/** r,

  /usr/share/apache2/icons/** r,

  /usr/share/misc/magic.mime r,

  /usr/share/snmp/mibs r,

  /usr/share/snmp/mibs/*.{txt,mib} r,

  /usr/share/snmp/mibs/.index rw,

  /var/lib/apache2/ssl_mutex w,

  /var/log/apache2/* rwl,

  ^DEFAULT_URI flags=(attach_disconnected) {

    #include <abstractions/apache2-common>

    /proc/meminfo r,

    /usr/share/zoneinfo/ r,

    /usr/share/zoneinfo/** r,

    /var/log/apache2/access_log w,

    /var/log/apache2/error_log w,

  }

  ^HANDLING_UNTRUSTED_INPUT flags=(complain,attach_disconnected) {

    #include <abstractions/nameservice>

    signal receive set=usr1 peer=httpd2-prefork,

    /**/.htaccess r,

    /dev/urandom r,

    /proc/*/attr/current w,

    /var/lib/apache2/ssl_mutex wk,

    /var/log/apache2/access_log w,

    /var/log/apache2/error_log w,

    /var/log/apache2/error_log-20[12][0-9][01][0-9][0-3][0-9] w,

    /var/log/apache2/ssl_request_log w,

    # strange, but happens in practise

    /var/log/apache2/cn-access_log w,

    /var/log/apache2/files-access_log w,

  }

  ^localhost flags=(complain,attach_disconnected) {

    /proc/*/attr/current rw,

    /proc/loadavg r,

    /var/log/apache2/access_log w,

  }

  ^vhost_files flags=(attach_disconnected) {

    #include <abstractions/apache2-common>

    signal receive set=usr1 peer=httpd2-prefork,

    /var/log/apache2/files-access_log w,

    /var/log/apache2/files-access_log-20[12][0-9][01][0-9][0-3][0-9] w,

    /var/log/apache2/error_log w,

    /srv/www/files.opensuse.org/public/ r,

    /srv/www/files.opensuse.org/public/** r,

  }

  #  {% for wiki in pillar['mediawiki']['wikis']|sort %}

  ^vhost_{{wiki}}wiki flags=(complain,attach_disconnected) {

    #include <abstractions/apache2-common>

    #include <abstractions/base>

    signal receive set=usr1 peer=httpd2-prefork,

    / r,

    /bin/bash rix,

    /dev/tty rw,

    /proc/meminfo r,

    /usr/bin/timeout rix,

    /usr/share/mediawiki_1_*/extensions/SyntaxHighlight_GeSHi/pygments/pygmentize Px -> pygmentize,

    /usr/sbin/sendmail PUx,

    /var/log/apache2/{{wiki}}-access_log w,

    /var/log/apache2/{{wiki}}-access_log-20[12][0-9][01][0-9][0-3][0-9] w,

    /var/log/apache2/error_log w,

    /srv/www/{{wiki}}.opensuse.org/cache/ r,

    /srv/www/{{wiki}}.opensuse.org/cache/* rw,

    /srv/www/{{wiki}}.opensuse.org/public/ r,

    /srv/www/{{wiki}}.opensuse.org/public/** r,

    /srv/www/{{wiki}}.opensuse.org/public/images/**/ rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/**.@{wiki_upload_extensions} rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/deleted/**/index.html rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/deleted/.htaccess rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/lockdir/*.lock rwk,

    /srv/www/{{wiki}}.opensuse.org/public/images/temp/*/*/*\!localcopy_*. rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/temp/*/*/*\!php??????. rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/temp/**/index.html rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/temp/.htaccess rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/temp/localcopy_* rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/temp/mw-runJobs-backoffs.json rwk,

    /srv/www/{{wiki}}.opensuse.org/public/images/temp/ResourceLoaderImage?????? rw,

    /srv/www/{{wiki}}.opensuse.org/public/images/temp/svg_*/ rw,

    /srv/www/{{wiki}}.opensuse.org/tmp/php* rw,

    /srv/www/{{wiki}}.opensuse.org/secrets.php r,

    /srv/www/{{wiki}}.opensuse.org/wiki_settings.php r,

    /usr/share/icu/*/icudt*l.dat r,

    /usr/share/mediawiki_1_*/** r,

    /usr/bin/magick Px -> magick-{{wiki}},

  }

  #  {% endfor %}

}

# vim: ft=apparmor expandtab