symlink support

[Patrick Schleizer]

Could you please add an option to AppArmor to follow symlinks?

That would allow a cleaner solution than the workarounds that have been added by other projects. Such as:

- https://bugs.launchpad.net/bugs/132468
- https://bugs.launchpad.net/bugs/203898
- https://debathena.mit.edu/trac/ticket/166
- https://phabricator.whonix.org/T396

[Seth Arnold (seth-arnold)]

This is not a design choice that can be revisited; this is a consequence of the kernel internal implementation. Sorry.

[Christian Boltz (cboltz)]

You can use alias rules for directory symlinks - add them to /etc/apparmor.d/tunables/alias. This avoids the need to modify all profiles.

For example, my /tmp/ is a symlink to /home/sys-tmp/, and the alias rule for it is
    alias /tmp/ -> /home/sys-tmp/,

Another possible solution is using mount --bind instead of symlinks.

[Patrick Schleizer (adrelanos)]

Alright. Thank you, Christian! This is a much better solution to our issue.