# vim:syntax=apparmor abi , # NOTE: This profile uses TCP sockets by default # If you wish for php-fpm to listen to unix socket, # add the following permission to local/usr.bin.php-fpm # /path/to/your/unix/socket w, include # This is PHP open_basedir where script can only be executed from. # /home, /tmp have been removed to not open permissions too widely # /usr/share/pear have been removed to have its own permission @{PHP_BASEDIRS} = /srv/www/ /var/www/ /usr/share/webapps/ profile php-fpm /usr/bin/php-fpm { include include include include capability setgid, capability setuid, capability kill, /etc/php/php-fpm.conf r, /etc/php/php-fpm.d/* r, # This is set to make php-fpm work by default, but if you don't use these paths # add "deny @{PHP_BASEDIRS}/** r," to local.usr.bin.php-fpm and add read rights # to where your PHP app is located @{PHP_BASEDIRS}/** r, /usr/bin/php-fpm mr, /usr/share/pear/** r, /usr/share/php/fpm/status.html r, /var/log/php-fpm.log w, # Site-specific additions and overrides. See local/README for details. include if exists }