I have my "root" partition split into two: a normal one that contains most files and a second one used for those areas that can "grow". Concretely, this means, I have symlinks like:

/var/log   -> /part1/log
/var/cache -> /part1/cache
/var/spool -> /part1/spool

This worked well until I started using AppArmor which keeps complaining about things like cupsd looking at files in /part1/log/cups/..

I currently work around this problem by adding entries for each application protected by AppArmor, but this is tedious.

Is there some way to tell AppArmor once and forall that if access to /var/log/FOO is allowed than access to /part1/log/FOO should also be allowed?

  • Look at using the apparmor genprofile utility. That way you can see exactly what is begin effected as processes run. – Raman Sailopal May 24 '18 at 14:56
  • @RamanSailopal:IIUC genprofcreates new profiles, whereas I'd like to rely on the profiles that Debian provides. – Stefan May 24 '18 at 15:09
  • You can use genprof to amend existing profiles as well as seeing what resources are affected by processes also. – Raman Sailopal May 24 '18 at 16:47
  • @RamanSailopal: It's still something that needs to be done for each application, so it's not fundamentally better than what I do manually. My question is specifically for a way to solve this once and for all (since the symlinks apply to all applications). – Stefan May 24 '18 at 21:35
  • 1
    Bug about the same problem (with some of the same solutions): bugs.launchpad.net/apparmor/+bug/1485055 – a3nm Nov 16 '18 at 15:52

It can be done in /etc/apparmor.d/tunables/alias as follows:

# Alias rules can be used to rewrite paths and are done after variable
# resolution. For example, if '/usr' is on removable media:
# alias /usr/ -> /mnt/usr/,
# Or if mysql databases are stored in /home:
# alias /var/lib/mysql/ -> /home/mysql/,

/var/log   -> /part1/log,
/var/cache -> /part1/cache,
/var/spool -> /part1/spool,

See also:


The only solution without changing your setup is to edit all profiles to point to the new locations. This can be done with pattern matching followed by careful review. It will also likely make upgrades more involved, since you will have to continuously apply these changes.

The simplest workaround would be to use bind mounts for these directories.

Adding the following to /etc/fstab should be enough to replace the symlinks:

/var/log /part1/log none defaults,bind 0 0
/var/cache /part1/cache none defaults,bind 0 0
/var/spool /part1/spool none defaults,bind 0 0

Make sure these lines come after the /part1 mount.

  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review – Thomas Aug 17 '18 at 9:49
  • How would these bind mounts be used in this situation? Please provide an example that addresses the specifics of the question. – roaima Aug 17 '18 at 11:04
  • @Thomas better? it gives an answer to the question (which is a poor solution) as well as a good solution to the problem implied by the question. – CameronNemo Aug 17 '18 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.