Le jeudi 13 août 2026, 15:22:13 heure d’été d’Europe centrale Hector Cao a écrit : > Package: apache2 > Followup-For: Bug #1125111 > User: [email protected] > Usertags: origin-ubuntu stonking ubuntu-patch > Control: tags -1 patch > > Dear Maintainer, > > The systemd hardening in debian/apache2.service and > debian/[email protected] sets ProtectSystem=full, which makes /etc > read-only at runtime. mod_md's default MDStoreDir is a directory named > "md" resolved relative to the server root (ServerRoot), i.e. > /etc/apache2/md for a normal install, or /etc/apache2-<instance>/md for > an [email protected] instance. That path was never added to > ReadWritePaths=, so any vhost using an "MDomain" directive fails to > start. > > Add an optional (dash-prefixed, so it is silently skipped if the > directory does not exist) ReadWritePaths= entry for /etc/apache2/md > (and its %i-instance equivalent). > > * d/apache2.service: allow mod_md to write its certificate store No this should be moved to /var/cache/md
Upstream have done some work could you get a glimpse at ti ? rouca > > > Thanks for considering the patch. > > > -- System Information: > Debian Release: trixie/sid > APT prefers noble-updates > APT policy: (500, 'noble-updates'), (500, 'noble-security'), (500, > 'noble'), (100, 'noble-backports') > Architecture: amd64 (x86_64) > > Kernel: Linux 7.0.0-28-generic (SMP w/16 CPU threads; PREEMPT) > Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE > Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not > set > Shell: /bin/sh linked to /usr/bin/dash > Init: systemd (via /run/systemd/system) > LSM: AppArmor: enabled >
signature.asc
Description: This is a digitally signed message part.
