@cboltz, I believe it was only running /bin/dash which was running /usr/bin/rrdtool, in addition to what is already in the profile. The following addition to the usr.sbin.apache2 profile made it work fine:
profile /bin/dash { #include <abstractions/base> #include <abstractions/fonts> #include <abstractions/nameservice> /bin/dash mr, /tmp/ganglia-graph.* w, /usr/bin/rrdtool r, /usr/share/ganglia-webfrontend/ r, /usr/bin/rrdtool ix, /var/lib/ganglia/rrds/**/ r, /var/lib/ganglia/rrds/**/*.rrd r, /var/log/apache2/error.log w, } And one more bug I had to solve to even figure out how to build the above was solved by using a more vanilla 3.17.2 kernel (which I chose because I already had a .deb handy) instead of the Ubuntu 3.13.0-39, which I already told you about on IRC -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1394612 Title: apparmor-utils on 14.04 aka trusty is completely unusable To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1394612/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs