BusinessTux
I know this is a little late to make a comment, but thankfully I found this entry from January 2024.
I recently moved my Grommunio install from an Ubuntu/LibVIRT / KVM on my workstation to a qemu VM on Proxmox Hypervisor running on a Dell PowerEdge R740xd server.
Once Grommunio was in its new install place, I did not do any zypper up for about a month. I wanted to ensure the Grommunio install was stable in its new home under Proxmox Hypervisor on the Dell R740xd server.
So, my install has run without issues for a month and I consider it stable on Proxmox.
Last night I did a zypper up ... there was a lot of updates to do.
After it finished, on the Webmail UI I was getting HTTP 403 error, but AdmWebUI https://192.168.x.x:8443 was working. The syslog had many errors regarding apparmor php-fpm profile.
An internet search for the error brought me to this thread, where the above solution by BusinessTux
So I created /etc/apparmor.d/local/php-fpm profile and then fixed my HTTP 403 error.
One other issue I noted was '/usr/share/gromox/' path was also being denied by apparmor, so I added the following two lines that are not shown in the above example from @BusinessTux:
/usr/share/gromox/** r,
/usr/share/gromox/**/ r,
Appparmor now has no denied errors, and no HTTP 403 errors are experienced in the Webmail UI.
As others have commented (in German), I did not change anything in Grommunio configs, I simply ran the 'zypper up', and this broke my mailserver.
This seems to be a bug or something overlooked?
But thank you very much for the quick fix!
/var/log/syslog
<snip> (duplicate entries omitted)
udit: type=1400 audit(1716296741.983:72): apparmor="DENIED" operation="open" profile="php-fpm" name="**/usr/share/gromox**/cpid.txt" pid=1514 comm="php-fpm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
audit: type=1400 audit(1716296741.983:73): apparmor="DENIED" operation="open" profile="php-fpm" name="/usr/share/gromox/lcid.txt" pid=1514 comm="php-fpm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
audit: type=1400 audit(1716296741.983:74): apparmor="DENIED" operation="open" profile="php-fpm" name="/usr/share/gromox/lang_charset.txt" pid=1514 comm="php-fpm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
audit: type=1400 audit(1716296741.983:75): apparmor="DENIED" operation="open" profile="php-fpm" name="/usr/share/gromox/mime_extension.txt" pid=1514 comm="php-fpm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
audit: type=1400 audit(1716296741.983:76): apparmor="DENIED" operation="open" profile="php-fpm" name="/usr/share/gromox/folder_names.txt" pid=1514 comm="php-fpm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
audit: type=1400 audit(1716296786.025:80): apparmor="DENIED" operation="open" profile="php-fpm" name="/usr/share/grommunio-web/grommunio.php" pid=1577 comm="php-fpm" requested_mask="r" denied_mask="r" fsuid=480 ouid=480
audit: type=1400 audit(1716296862.624:85): apparmor="DENIED" operation="open" profile="php-fpm" name="/usr/share/grommunio-web/index.php" pid=1573 comm="php-fpm" requested_mask="r" denied_mask="r" fsuid=480 ouid=480
audit: type=1400 audit(1716296904.241:86): apparmor="DENIED" operation="open" profile="php-fpm" name="/usr/share/grommunio-sync/index.php" pid=1563 comm="php-fpm" requested_mask="r" denied_mask="r" fsuid=463 ouid=0
