# [PROPOSAL] apparmor change_hat functionality in fpm

- Thread: https://externals.io/message/67428
- Original archive: https://news-web.php.net/php.internals/67428
- Started by Gernot Vormayr on 2013-05-15T12:52:48+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #67428 — Gernot Vormayr — 2013-05-15T12:52:48+00:00

URL: https://externals.io/message/67428#67428

Hi!

The basic idea behind this is to get a better seperation of different php
pools (so e.g. php scripts from one pool can't access the other and vice
versa).

I did a small patch (https://github.com/php/php-src/pull/343) that adds a
configuration parameter to pools (apparmor_hat). If this is set, workers of
the pool try to change the apparmor hat to the specified value.
The patch only touches fpm. Only thing that's needed is libapparmor - if it
is not there the functionality just gets left out.

To keep things simple this version is very coarse - meaning it is not
possible to change the hat back, or change to a different hat according to
the executed script.


Any thoughts on this?