apparmor rules for php* broken

Is this a new report?

Yes

System Info

Void 6.19.14_1 x86_64 AuthenticAMD notuptodate rrrrrmdFFFFFFFFFFFFFFFF

Package(s) Affected

php-fpm-8.5_1, apparmor-4.1.7_2

Does a report exist for this bug with the project's home (upstream) and/or another distro?

No response

Expected behaviour

apparmor doesn't block default config

Actual behaviour

audit.log

type=AVC msg=audit(1789235995.945:1159453): apparmor="DENIED" operation="open" class="file" profile="php-fpm" name="/etc/php8.5/php.ini" pid=13088 comm="php-fpm8.5" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=SYSCALL msg=audit(1789235995.945:1159453): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=7fff033e00c0 a2=0 a3=0 items=0 ppid=7572 pid=13088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="php-fpm8.5" exe="/usr/bin/php-fpm8.5" subj=php-fpm key=(null)ARCH=x86_64 SYSCALL=openat AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1789235995.945:1159453): proctitle=7068702D66706D382E35002D2D6E6F6461656D6F6E697A65
type=AVC msg=audit(1789235995.945:1159454): apparmor="DENIED" operation="open" class="file" profile="php-fpm" name="/etc/php8.5/conf.d/" pid=13088 comm="php-fpm8.5" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=SYSCALL msg=audit(1789235995.945:1159454): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7f9469801018 a2=90800 a3=0 items=0 ppid=7572 pid=13088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="php-fpm8.5" exe="/usr/bin/php-fpm8.5" subj=php-fpm key=(null)ARCH=x86_64 SYSCALL=openat AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1789235995.945:1159454): proctitle=7068702D66706D382E35002D2D6E6F6461656D6F6E697A65
type=AVC msg=audit(1789235995.949:1159455): apparmor="DENIED" operation="open" class="file" profile="php-fpm" name="/etc/php8.5/php-fpm.conf" pid=13088 comm="php-fpm8.5" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=SYSCALL msg=audit(1789235995.949:1159455): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=561740dcd200 a2=0 a3=0 items=0 ppid=7572 pid=13088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="php-fpm8.5" exe="/usr/bin/php-fpm8.5" subj=php-fpm key=(null)ARCH=x86_64 SYSCALL=openat AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1789235995.949:1159455): proctitle=7068702D66706D382E35002D2D6E6F6461656D6F6E697A65

Steps to reproduce

The current apparmor rules do not allow read access to /etc/php/8.*/**

$ php-fpm8.5 --nodaemonize
[12-Sep-2026 19:51:35] ERROR: failed to open configuration file '/etc/php8.5/php-fpm.conf': Permission denied (13)
[12-Sep-2026 19:51:35] ERROR: failed to load configuration file '/etc/php8.5/php-fpm.conf'
[12-Sep-2026 19:51:35] ERROR: FPM initialization failed

Start by locating the current AppArmor rules for php-fpm and compare their permitted paths with the denied /etc/php8.5/php.ini, /etc/php8.5/conf.d/, and /etc/php8.5/php-fpm.conf accesses. Reproduce with php-fpm8.5 --nodaemonize; done means the default configuration starts without permission errors or corresponding AppArmor denials.