Merge lp:~clint-fewbar/charms/oneiric/statusnet/apparmor into lp:charms/oneiric/statusnet

[Clint Byrum]

Adds an apparmor profile that was recorded manually using the new charm-helper for apparmor. Note that it has not landed in the PPA yet, so this will fail until revision 115 builds and
publishes in the PPA.

[lp:~clint-fewbar/charms/oneiric/statusnet/apparmor]

13. By Clint Byrum on 2012-01-12

adding setuid

14. By Clint Byrum on 2012-01-12

removing redundant php5 rules

Unmerged revisions

14. By Clint Byrum on 2012-01-12

removing redundant php5 rules

13. By Clint Byrum on 2012-01-12

adding setuid

12. By Clint Byrum on 2012-01-12

Adding AppArmor profile to confine webapp

=== added directory 'apparmor'
=== added directory 'apparmor/profiles.d'
=== added file 'apparmor/profiles.d/usr.lib.apache2.mpm-prefork.apache2'
--- apparmor/profiles.d/usr.lib.apache2.mpm-prefork.apache2	1970-01-01 00:00:00 +0000
+++ apparmor/profiles.d/usr.lib.apache2.mpm-prefork.apache2	2012-01-12 11:47:23 +0000
@@ -0,0 +1,37 @@
+# Last Modified: Wed Jan 11 17:10:37 2012
+#include <tunables/global>
+
+/usr/lib/apache2/mpm-prefork/apache2 {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/php5>
+  #include <abstractions/ssl_certs>
+  #include <abstractions/user-tmp>
+
+  capability kill,
+  capability setgid,
+  capability setuid,
+
+
+  /etc/apache2/** r,
+  /etc/apache2/**/ r,
+  /etc/mime.types r,
+  /run/apache2.pid rw,
+  /sys/devices/system/cpu/ r,
+  /usr/lib/apache2/** mr,
+  /var/log/apache2/* w,
+  /var/www/ r,
+  /var/www/** r,
+  /var/www/avatar/* rw,
+
+
+  ^DEFAULT_URI {
+
+
+  }
+
+  ^HANDLING_UNTRUSTED_INPUT {
+
+
+  }
+}
 
=== modified file 'hooks/install'
--- hooks/install	2011-12-08 13:28:00 +0000
+++ hooks/install	2012-01-12 11:47:23 +0000
@@ -51,6 +51,9 @@
 </VirtualHost>
 EOD
 
+. /usr/share/charm-helper/sh/apparmor.sh
+ch_apparmor_load
+
 juju-log "Restarting Apache"
 service apache2 restart