I have a small shared server where couple of websites are hosted, so I'm not sure if this kind of protection will be enough to prevent attackers from executing symlink attack.
symlink to disabled PHP functions and of course others like exec to prevent from executing
apparmor is there in order to prevent some kind of damage.
Even if I allow all PHP functions and those dangerous, apparmor will block
apparmor="DENIED" operation="exec" profile="/usr/sbin/apache2" name="/bin/ln"
Is this sufficient protection against symlink attack?