Can someone outline the semantics of AppArmor with respect to bind-mounted folders?
As I understand after reading the documentation (1, 2, 3, 4) - yes, I am using Ubuntu 12.04 with the 3.8 kernel - the policies are "attached to paths" (i.e. paths of programs that become processes when invoked).
So assume I have the folder
/home/joe/Public and that has the location
/var/www/html/joe bind-mounted to it.
Will I have to create a profile that covers the original and the bind-mounted, one of them (which) or is there something else I'd have to do or to consider?
Let's say there is a program
/var/www/html/joe/foo, will the confinement still work when the profile/rule only mentions
/var/www/html/joe/foo, but Joe decides to run it as
Links and other pointers will also be appreciated.