AppArmor and bind-mounts

Question

Can someone outline the semantics of AppArmor with respect to bind-mounted folders?

As I understand after reading the documentation (1, 2, 3, 4) - yes, I am using Ubuntu 12.04 with the 3.8 kernel - the policies are "attached to paths" (i.e. paths of programs that become processes when invoked).

So assume I have the folder /home/joe/Public and that has the location /var/www/html/joe bind-mounted to it.

Will I have to create a profile that covers the original and the bind-mounted, one of them (which) or is there something else I'd have to do or to consider?

Let's say there is a program /var/www/html/joe/foo, will the confinement still work when the profile/rule only mentions /var/www/html/joe/foo, but Joe decides to run it as /home/joe/Public/foo?

Links and other pointers will also be appreciated.

Answer 1

I don't have a definitive reference nor direct experience, so this is not an authoritative answer.

AppArmor is based on paths (after resolving symbolic links, I believe). Paths don't care about mount points. An AppArmor rule for /var/www/html/joe/foo applies to a file accessed through that path. The path /home/joe/Public/foo may happen to designate the same file, but since it's a different path, the AppArmor rules for /var/www/html/joe/foo do not apply.

You'll have to define rules that cover all the bind-mount locations. You don't have to repeat your rules, however. You can tell AppArmor that a location is an alias for another.

alias /home/joe/Public -> /var/www/html/joe

I don't think you can use a wildcard to have one alias apply automatically to all users. For that, you can express your rules using variables.

@{WWW_DIRS} = /home/*/Public /var/www/html/*
…
@{WWW_DIRS}/foo …