SOC/scripts/apparmor-apache2-pa85.conf at main · 0xCyberLiTech/SOC · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
include <tunables/global>

# AppArmor profile — Apache2 sur VM pa85 (<PA85-IP>)
# Site associatif PA85 + PHP (send-rdv.php) + ModSecurity OWASP CRS
# Créé le 2026-04-11 par 0xCyberLiTech

/usr/sbin/apache2 {

  # Binaires + bibliothèques
  /usr/sbin/apache2  mr,
  /usr/lib/**        mr,
  /lib/**            mr,
  /lib64/**          mr,

  # Linker + libc
  /etc/ld.so.cache   r,

  # Config système
  /etc/php/         r,
  /etc/php/**       r,
  /etc/apache2/      r,
  /etc/apache2/**    r,
  /etc/modsecurity/  r,
  /etc/modsecurity/** r,
  /usr/share/modsecurity-crs/  r,
  /usr/share/modsecurity-crs/** r,
  /etc/ssl/          r,
  /etc/ssl/**        r,
  /etc/nsswitch.conf r,
  /etc/passwd        r,
  /etc/group         r,
  /etc/hosts         r,
  /etc/host.conf     r,
  /etc/resolv.conf   r,
  /etc/localtime     r,
  /etc/mime.types    r,
  /etc/locale.alias  r,
  /etc/gai.conf      r,
  /etc/machine-id      r,

  # Timezone
  /usr/share/zoneinfo/  r,
  /usr/share/zoneinfo/** r,

  # Webroot (lecture seule — sauf PHP upload tmp)
  /var/www/pa85/      r,
  /var/www/pa85/**    r,
  /var/www/html/      r,
  /var/www/html/**    r,
  /usr/share/apache2/  r,
  /usr/share/apache2/** r,

  # PHP — sessions + tmp
  /var/lib/php/       r,
  /var/lib/php/**     rw,
  /tmp/               rw,
  /tmp/**             rw,

  # Logs
  /var/log/apache2/   rw,
  /var/log/apache2/** rw,
  /var/lib/modsecurity/      rw,
  /var/lib/modsecurity/**    rwk,

  # Runtime
  /run/apache2/       rw,
  /run/apache2/**     rw,
  /run/lock/          r,
  /run/lock/apache2/  rw,
  /run/lock/apache2/** rw,
  /run/systemd/userdb/ r,

  # Proc
  @{PROC}/@{pid}/    r,
  @{PROC}/sys/kernel/random/boot_id  r,
  @{PROC}/@{pid}/**  r,
  @{PROC}/sys/kernel/ngroups_max r,

  # Dev
  /dev/urandom        r,
  /dev/null           rw,
  /dev/zero           rw,

  # Réseau (TCP + UDP + netlink)
  network inet  stream,
  network inet6 stream,
  network inet  dgram,
  network inet6 dgram,
  network netlink raw,
  network unix  stream,
  network unix  dgram,


  # Capacités
  capability net_bind_service,
  capability setuid,
  capability setgid,
  capability dac_override,
  capability kill,
  capability chown,

  # Signaux inter-workers Apache
  signal peer=/usr/sbin/apache2,
  signal peer=unconfined,
  ptrace (readby),
  ptrace (tracedby),

  # syslog pipe pour CustomLog (rsyslog centralisé)
  /usr/bin/logger rix,
  /dev/log rw,
}