#include <tunables/global>

/usr/sbin/httpd.prefork {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  /usr/sbin/httpd.prefork mr,

  capability setuid,
  capability setgid,
  capability kill,

  /etc/httpd/apache.conf r,
  /etc/httpd/conf.d r,
  /etc/httpd/conf.d/* r,
  /usr/lib{,64}/apache/*.so mr,
  /etc/httpd/webapps.d r,
  /etc/gai.conf r,
  /etc/httpd/magic r,
  /etc/mime.types r,
  /var/log/httpd/* w,
  /etc/php4/** r,
  /usr/lib{,64}/php4/*.so mr,
  /etc/php/** r,
  /usr/lib{,64}/php/*.so mr,
  /var/run/httpd.pid w,
  /proc/[0-9]*/attr/current rw,
  /etc/snmp/** r,
  /usr/share/snmp/** r,

}

^HANDLING_UNTRUSTED_INPUT {
}

^HAT_no_access {
 /bin/* x,
 /usr/bin/* x,
}