ERROR: /etc/apparmor.d/apache2.d/phpsysinfo doesn't contain a valid profile (syntax error?)

SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Application 15

Unable to set the apache2//phpsysinfo profile to complain mode using the aa-complain command.

# aa-complain /etc/apparmor.d/apache2.d/phpsysinfo
Setting /etc/apparmor.d/apache2.d/phpsysinfo to complain mode.

ERROR: /etc/apparmor.d/apache2.d/phpsysinfo doesn't contain a valid profile (syntax error?)

The following example demonstrates how to create a new profile called myphpsysinfo based on phpsysinfo, and how to switch between complain mode and enforce mode by editing the myphpsysinfo file in steps 1 and 2.

Note: There is no method to switch modes without editing this file.

Example )

# cp /etc/apparmor.d/apache2.d/phpsysinfo /etc/apparmor.d/apache2.d/myphpsysinfo
# mv /etc/apparmor.d/apache2.d/phpsysinfo /tmp

1. Complain Mode

Remove the line "^phpsysinfo {" and add the following line:

# vi /etc/apparmor.d/apache2.d/myphpsysinfo
...
profile myphpsysinfo flags=(complain) {
...

# aa-complain /usr/sbin/apache2
# aa-status
...
4 profiles are in complain mode.
...
apache2//myphpsysinfo
...

2. Enforce Mode

Remove the flags=(complain) edited in step 1.

# vi /etc/apparmor.d/apache2.d/myphpsysinfo
...
profile myphpsysinfo {
...

# aa-enforce /usr/sbin/apache2
# aa-status
...
56 profiles are in enforce mode.
...
apache2//myphpsysinfo
...

The file /etc/apparmor.d/apache2.d/phpsysinfo is not intended to be used as an independent "profile". Instead, it is meant to be included in an existing "profile" (e.g., usr.sbin.apache2). In other words, to set phpsysinfo to complain mode, you need to set the entire apache2 to complain mode, as shown below:

# aa-complain /usr/sbin/apache2

Additionally, the existing phpsysinfo profile is considered an example, it is outdated and may not be adequately maintained. Therefore, it is recommended to create a custom profile tailored to the user's specific requirements.