New feature: re-attached path

[roddhjav]

For more context, see https://apparmor.pujol.io/development/internal/#re-attached-path

AppAmor 4.0 provides the attach_disconnect.path flag allowing to reattach this path to a prefix that is not /. When used it provides an important security improvement from AppArmor 3.0.

The plan is to uses attach_disconnect.path by default and automatically on all profiles with the attach_disconnect flag. The attached path is set to a @{att}, a new dynamically generated variable set at build time in the preamble of all profile to be:

• @{att}=/att/<profile_name> for profile with attach_disconnect flag.
• @{att}=/ for other profiles
• When the feature is disabled (for abi3), the variable is defined as a global tunable and set to @{att}=/

Internal

• New abstractions/attached/base abstraction
• New abstractions/attached/consoles abstraction
• New attach build tasks:
  • Add the attach_disconnected.path flag on all profile with the attach_disconnected flag
  • Add the attached/base abstraction in the profile
• Fallback for ABI3: globally defined @{att}=/

Tasks

• Ensure all profiles with attach_disconnect have been updated to use @{att} when required.
• Compatibility issue with abi3:
  • Issues with the dbus-system and the issue-generator profiles #558
  • xdg-desktop-portal can't access .flatpak-info #557
  • gdm & gnome couldn't start after upgrading to the latest apparmor.d #555

[curiosityseeker]

The plan is to uses attach_disconnect.path by default and automatically on all profiles with the attach_disconnect flag. The attached path is set to a @{att}, a new dynamically generated variable set at build time in the preamble of all profile to be:

* `@{att}=/att/<profile_name>` for profile with `attach_disconnect` flag.

* `@{att}=/` for other profiles

This is what I don't understand. @{att}=/att/<profile_name> is for profiles with the attach_disconnect flag - okay. But @{att}=/ for other profiles, i.e. without the attach_disconnect flag? Why should this be needed for such profiles at all? That sounds to me like a oxymoron :)

[roddhjav]

As @{att} can be used in abstraction, profile without the attach_disconnect flag need to have the variable defined. It is mostly a safety measure to ensure the profiles compile.

[curiosityseeker]

Ah, understood! Thanks!

[beroal]

As @{att} can be used in abstraction, profile without the attach_disconnect flag need to have the variable defined. It is mostly a safety measure to ensure the profiles compile.

Why not @{att}=/giekxhayfnjdhaeb?

[roddhjav]

@beroal Because it is not what we want. If a profile doesn't have the attach_disconnect flag it may still needs similar access but from /.

[beroal]

Is it attach_disconnect or attach_disconnected?

[roddhjav]

attach_disconnected