Can someone outline the semantics of AppArmor with respect to bind-mounted folders?

As I understand after reading the documentation (1, 2, 3, 4) - yes, I am using Ubuntu 12.04 with the 3.8 kernel - the policies are "attached to paths" (i.e. paths of programs that become processes when invoked).

So assume I have the folder /home/joe/Public and that has the location /var/www/html/joe bind-mounted to it.

Will I have to create a profile that covers the original and the bind-mounted, one of them (which) or is there something else I'd have to do or to consider?

Let's say there is a program /var/www/html/joe/foo, will the confinement still work when the profile/rule only mentions /var/www/html/joe/foo, but Joe decides to run it as /home/joe/Public/foo?

Links and other pointers will also be appreciated.


I don't have a definitive reference nor direct experience, so this is not an authoritative answer.

AppArmor is based on paths (after resolving symbolic links, I believe). Paths don't care about mount points. An AppArmor rule for /var/www/html/joe/foo applies to a file accessed through that path. The path /home/joe/Public/foo may happen to designate the same file, but since it's a different path, the AppArmor rules for /var/www/html/joe/foo do not apply.

You'll have to define rules that cover all the bind-mount locations. You don't have to repeat your rules, however. You can tell AppArmor that a location is an alias for another.

alias /home/joe/Public -> /var/www/html/joe

I don't think you can use a wildcard to have one alias apply automatically to all users. For that, you can express your rules using variables.

@{WWW_DIRS} = /home/*/Public /var/www/html/*
@{WWW_DIRS}/foo …

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.