From 103d7fc66290265dc6c4f6abbe2a815f90789256 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ebbe=20Ba=C3=9F?= Date: Thu, 16 Jul 2026 11:35:03 +0200 Subject: [PATCH] added apparmor write permission --- .../deploy_hardened_nextcloud.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml index 3181028..1482a64 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml @@ -437,6 +437,20 @@ line: "open_basedir = {{ nextcloud_install_dir }}:{{ nextcloud_data_dir }}:/tmp:/dev/urandom" notify: Restart Apache + - name: Allow Apache AppArmor profile to write to Nextcloud config + ansible.builtin.blockinfile: + path: /etc/apparmor.d/local/usr.sbin.apache2 + create: true + owner: root + group: root + mode: "0644" + block: | + {{ nextcloud_install_dir }}/ r, + {{ nextcloud_install_dir }}/** rw, + {{ nextcloud_data_dir }}/ r, + {{ nextcloud_data_dir }}/** rw, + notify: Reload AppArmor + # --------------------------------------------------------------- # Setup fail2ban for Nextcloud # --------------------------------------------------------------- @@ -497,5 +511,7 @@ ansible.builtin.systemd: name: apache2 state: restarted + - name: Reload AppArmor + ansible.builtin.command: apparmor_parser -r /etc/apparmor.d/usr.sbin.apache2 # This file was written by Ebbe Baß (umpi) - ebbe@ping-mee.de \ No newline at end of file