Bug#1125111: apache2: Apache2 won't start, error "Read-only file system: AH10082: Can't change owner of /etc/apache2/md/challenges"

Hello Bastien,

I cannot find what you seem to be referring to.
I would love to have some pointers

Hector

On Thu, Aug 13, 2026 at 3:51 PM Bastien Roucaries <[email protected]> wrote:

> Le jeudi 13 août 2026, 15:22:13 heure d’été d’Europe centrale Hector Cao a
> écrit :
> > Package: apache2
> > Followup-For: Bug #1125111
> > User: [email protected]
> > Usertags: origin-ubuntu stonking ubuntu-patch
> > Control: tags -1 patch
> >
> > Dear Maintainer,
> >
> >     The systemd hardening in debian/apache2.service and
> >     debian/[email protected] sets ProtectSystem=full, which makes /etc
> >     read-only at runtime. mod_md's default MDStoreDir is a directory
> named
> >     "md" resolved relative to the server root (ServerRoot), i.e.
> >     /etc/apache2/md for a normal install, or /etc/apache2-<instance>/md
> for
> >     an [email protected] instance. That path was never added to
> >     ReadWritePaths=, so any vhost using an "MDomain" directive fails to
> >     start.
> >
> >     Add an optional (dash-prefixed, so it is silently skipped if the
> >     directory does not exist) ReadWritePaths= entry for /etc/apache2/md
> >     (and its %i-instance equivalent).
> >
> >   * d/apache2.service: allow mod_md to write its certificate store
> No this should be moved to /var/cache/md
>
> Upstream have done some work could you get a glimpse at ti ?
>
> rouca
>
>
> >
> >
> > Thanks for considering the patch.
> >
> >
> > -- System Information:
> > Debian Release: trixie/sid
> >   APT prefers noble-updates
> >   APT policy: (500, 'noble-updates'), (500, 'noble-security'), (500,
> 'noble'), (100, 'noble-backports')
> > Architecture: amd64 (x86_64)
> >
> > Kernel: Linux 7.0.0-28-generic (SMP w/16 CPU threads; PREEMPT)
> > Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
> > Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE
> not set
> > Shell: /bin/sh linked to /usr/bin/dash
> > Init: systemd (via /run/systemd/system)
> > LSM: AppArmor: enabled
> >
>
>

-- 
Hector CAO
Software Engineer – Server Team / Virtualization
[email protected]
https://launc <https://launchpad.net/~hectorcao>hpad.net/~hectorcao
<https://launchpad.net/~hectorcao>

<https://launchpad.net/~hectorcao>