Can someone outline the semantics of AppArmor with respect to bind-mounted folders?
As I understand after reading the documentation (1, 2, 3, 4) - yes, I am using Ubuntu 12.04 with the 3.8 kernel - the policies are "attached to paths" (i.e. paths of programs that become processes when invoked).
So assume I have the folder /home/joe/Public
and that has the location /var/www/html/joe
bind-mounted to it.
Will I have to create a profile that covers the original and the bind-mounted, one of them (which) or is there something else I'd have to do or to consider?
Let's say there is a program /var/www/html/joe/foo
, will the confinement still work when the profile/rule only mentions /var/www/html/joe/foo
, but Joe decides to run it as /home/joe/Public/foo
?
Links and other pointers will also be appreciated.