  ^piwik_hat {
    #include <abstractions/base>
    #include <abstractions/nameservice>

    # Note that mod_perl, mod_php, mod_python, etc, allows in-apache
    # execution of content regardless of 'x' permissions, as no exec(2)
    # takes place to perform a domain change.

    # suexec execution of CGIs will require appropriate permissions
    /usr/sbin/suexec2 mixr,

    # Allow logging
    /var/log/apache2/** rwl,

    @{PROC}/**/attr/current rw,
    @{PROC}/sys/** rw,

    # Allow site-wide CGIs to run, inheriting the apache profile:
    # /srv/www/cgi-bin/**        mixr,
    # /var/www/cgi-bin/**        mixr,

    /etc/piwik                   r,
    /usr/share/piwik             r,
    /usr/share/piwik/**          r,

    # SuSE location of the apache manual + error pages
    /usr/share/apache2/**        r,

    # php
    /etc/php5/** r,
    /var/lib/php5/ rw,
    /var/lib/php5/* rwlkm,

    # piwik specific stuff:
    /usr/share/piwik/tmp/**        rwlk,
    /usr/share/piwik/**            rwlk,

  }

