How to enable thp and mmap for firejail-default apparmor profile?

[osevan]

im using php-fpm inside firejail default since 6 years with apparmor enabled.

but i want not ignore apparmor denied messages, because i think mmap of libsxxx.so is needed for some php apps .

Feb 20 21:24:04 8 firejail[1585241]: AppArmor enabled
Feb 20 21:24:04 8 kernel: audit: type=1400 audit(1740083044.273:1168): apparmor="DENIED" operation="file_mmap" class="file" profile="firejail-default" name="/" pid=1585241 comm="php-fpm" requested_mask="w" denied_mask="w" fsuid=105 ouid=105

my strace file is huge, i see lots of mmap function calls

4002805 openat(AT_FDCWD, "/usr/lib/dovecot/glibc-hwcaps/x86-64-v2/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
4002805 openat(AT_FDCWD, "/usr/lib/dovecot/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
4002805 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
4002805 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
4002805 mmap(0x7fcbda205000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fcbda205000
4002805 openat(AT_FDCWD, "/usr/lib/dovecot/libbz2.so.1.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
4002805 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libbz2.so.1.0", O_RDONLY|O_CLOEXEC) = 3
4002805 mmap(0x7fcbda1f1000, 53248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fcbda1f1000
4002805 openat(AT_FDCWD, "/usr/lib/dovecot/liblzma.so.5", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
4002805 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/liblzma.so.5", O_RDONLY|O_CLOEXEC) = 3
4002805 mmap(0x7fcbda1c2000, 126976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7fcbda1c2000
4002805 openat(AT_FDCWD, "/usr/lib/dovecot/liblz4.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
4002805 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/liblz4.so.1", O_RDONLY|O_CLOEXEC) = 3
4002805 mmap(0x7fcbda19a000, 126976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fcbda19a000
4002805 openat(AT_FDCWD, "/usr/lib/dovecot/libzstd.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
4002805 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libzstd.so.1", O_RDONLY|O_CLOEXEC) = 3
4002805 mmap(0x7fcbda0d4000, 708608, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7fcbda

maybe someone have idea how i can enable mmap for firejail-default

i know about owner filepath rwm, <-- m is for mmap i guess according apparmor threads

thanks and

best regards

[kmk3]

(Offtopic)

Please see the following links for how to format code blocks in markdown:

• https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks
• https://github.github.com/gfm/#fenced-code-blocks

[osevan]

I hope better now