Bug#1125111: apache2: Apache2 won't start, error "Read-only file system: AH10082: Can't change owner of /etc/apache2/md/challenges"

[Hector Cao]

Package: apache2
Followup-For: Bug #1125111
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu stonking ubuntu-patch
Control: tags -1 patch

Dear Maintainer,

    The systemd hardening in debian/apache2.service and
    debian/apache2@.service sets ProtectSystem=full, which makes /etc
    read-only at runtime. mod_md's default MDStoreDir is a directory named
    "md" resolved relative to the server root (ServerRoot), i.e.
    /etc/apache2/md for a normal install, or /etc/apache2-<instance>/md for
    an apache2@.service instance. That path was never added to
    ReadWritePaths=, so any vhost using an "MDomain" directive fails to
    start.
    
    Add an optional (dash-prefixed, so it is silently skipped if the
    directory does not exist) ReadWritePaths= entry for /etc/apache2/md
    (and its %i-instance equivalent).

  * d/apache2.service: allow mod_md to write its certificate store


Thanks for considering the patch.


-- System Information:
Debian Release: trixie/sid
  APT prefers noble-updates
  APT policy: (500, 'noble-updates'), (500, 'noble-security'), (500, 'noble'), 
(100, 'noble-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.0-28-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

diff -Nru apache2-2.4.68/debian/apache2.service 
apache2-2.4.68/debian/apache2.service
--- apache2-2.4.68/debian/apache2.service       2026-06-11 13:39:32.000000000 
+0200
+++ apache2-2.4.68/debian/apache2.service       2026-08-13 15:10:35.000000000 
+0200
@@ -39,6 +39,7 @@
 
 ReadWritePaths=-/var/log/apache2
 ReadWritePaths=-/var/cache/apache2/mod_cache_disk
+ReadWritePaths=-/etc/apache2/md
 
 InaccessiblePaths=/boot
 InaccessiblePaths=/root
diff -Nru apache2-2.4.68/debian/apache2@.service 
apache2-2.4.68/debian/apache2@.service
--- apache2-2.4.68/debian/apache2@.service      2026-06-11 13:39:32.000000000 
+0200
+++ apache2-2.4.68/debian/apache2@.service      2026-08-13 15:17:09.000000000 
+0200
@@ -40,7 +40,7 @@
 
 ReadWritePaths=-/var/log/apache2-%i
 ReadWritePaths=-/var/cache/apache2-%i/mod_cache_disk
-
+ReadWritePaths=-/etc/apache2-%i/md
 
 InaccessiblePaths=/boot
 InaccessiblePaths=/root