Bug#1125111: apache2: Apache2 won't start, error "Read-only file system: AH10082: Can't change owner of /etc/apache2/md/challenges"

Package: apache2
Followup-For: Bug #1125111
User: [email protected]
Usertags: origin-ubuntu stonking ubuntu-patch
Control: tags -1 patch

Dear Maintainer,

    The systemd hardening in debian/apache2.service and
    debian/[email protected] sets ProtectSystem=full, which makes /etc
    read-only at runtime. mod_md's default MDStoreDir is a directory named
    "md" resolved relative to the server root (ServerRoot), i.e.
    /etc/apache2/md for a normal install, or /etc/apache2-<instance>/md for
    an [email protected] instance. That path was never added to
    ReadWritePaths=, so any vhost using an "MDomain" directive fails to
    start.
    
    Add an optional (dash-prefixed, so it is silently skipped if the
    directory does not exist) ReadWritePaths= entry for /etc/apache2/md
    (and its %i-instance equivalent).

  * d/apache2.service: allow mod_md to write its certificate store


Thanks for considering the patch.


-- System Information:
Debian Release: trixie/sid
  APT prefers noble-updates
  APT policy: (500, 'noble-updates'), (500, 'noble-security'), (500, 'noble'), (100, 'noble-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.0-28-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

diff -Nru apache2-2.4.68/debian/apache2.service apache2-2.4.68/debian/apache2.service
--- apache2-2.4.68/debian/apache2.service	2026-06-11 13:39:32.000000000 +0200
+++ apache2-2.4.68/debian/apache2.service	2026-08-13 15:10:35.000000000 +0200
@@ -39,6 +39,7 @@
 
 ReadWritePaths=-/var/log/apache2
 ReadWritePaths=-/var/cache/apache2/mod_cache_disk
+ReadWritePaths=-/etc/apache2/md
 
 InaccessiblePaths=/boot
 InaccessiblePaths=/root
diff -Nru apache2-2.4.68/debian/[email protected] apache2-2.4.68/debian/[email protected]
--- apache2-2.4.68/debian/[email protected]	2026-06-11 13:39:32.000000000 +0200
+++ apache2-2.4.68/debian/[email protected]	2026-08-13 15:17:09.000000000 +0200
@@ -40,7 +40,7 @@
 
 ReadWritePaths=-/var/log/apache2-%i
 ReadWritePaths=-/var/cache/apache2-%i/mod_cache_disk
-
+ReadWritePaths=-/etc/apache2-%i/md
 
 InaccessiblePaths=/boot
 InaccessiblePaths=/root