mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-31 14:25:52 +00:00
766cd2d8a5
Initial profile for nginx, tested on Ubuntu 24.04 manually and with nginx testsuite. Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
68 lines
1.7 KiB
Plaintext
68 lines
1.7 KiB
Plaintext
#------------------------------------------------------------------
|
|
# Copyright (C) 2025 Canonical Ltd.
|
|
#
|
|
# Author: Maxime Bélair <maxime.belair@canonical.com>
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
# License published by the Free Software Foundation.
|
|
#------------------------------------------------------------------
|
|
# vim: ft=apparmor
|
|
|
|
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
# Standard config for webservers. This assumes that the server uses one of these directories.
|
|
# If it has been modified, change accordingly.
|
|
# Web directory location is available at /etc/nginx/sites-available/default
|
|
@{srv}=/var/www/html/** /srv/**
|
|
|
|
profile nginx /usr/{s,}bin/nginx {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/openssl>
|
|
include <abstractions/ssl_keys>
|
|
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
capability net_bind_service,
|
|
capability setgid,
|
|
capability setuid,
|
|
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network netlink raw,
|
|
|
|
# Configuration
|
|
file /etc/nginx/** r,
|
|
|
|
# Server directory
|
|
file @{srv} r,
|
|
|
|
# Support for modules, perl and lua
|
|
file /usr/share/nginx/** r,
|
|
file /usr/share/perl/*/**.pm r,
|
|
file /usr/share/lua/*/**.lua r,
|
|
|
|
|
|
# Temporary files
|
|
owner file /tmp/** rw,
|
|
|
|
# nginx libs
|
|
owner file /var/lib/nginx/** rw,
|
|
|
|
# logs
|
|
file /var/log/nginx/* w,
|
|
|
|
# Binaries
|
|
file @{exec_path} mr,
|
|
owner file /run/nginx.pid rw,
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
include if exists <local/nginx>
|
|
}
|
|
|