symlink support

Bug #1485055 reported by Patrick Schleizer
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
AppArmor
Won't Fix
Undecided
Unassigned

Bug Description

Could you please add an option to AppArmor to follow symlinks?

That would allow a cleaner solution than the workarounds that have been added by other projects. Such as:

- https://bugs.launchpad.net/bugs/132468
- https://bugs.launchpad.net/bugs/203898
- https://debathena.mit.edu/trac/ticket/166
- https://phabricator.whonix.org/T396

Tags: aa-kernel
Revision history for this message
Seth Arnold (seth-arnold) wrote :

This is not a design choice that can be revisited; this is a consequence of the kernel internal implementation. Sorry.

Changed in apparmor:
status: New → Won't Fix
Revision history for this message
Christian Boltz (cboltz) wrote :

You can use alias rules for directory symlinks - add them to /etc/apparmor.d/tunables/alias. This avoids the need to modify all profiles.

For example, my /tmp/ is a symlink to /home/sys-tmp/, and the alias rule for it is
    alias /tmp/ -> /home/sys-tmp/,

Another possible solution is using mount --bind instead of symlinks.

Revision history for this message
Patrick Schleizer (adrelanos) wrote :

Alright. Thank you, Christian! This is a much better solution to our issue.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers