New feature: re-attached path

[roddhjav]

For more context, see https://apparmor.pujol.io/development/internal/#re-attached-path

AppAmor 4.0 provides the attach_disconnect.path flag allowing to reattach this path to a prefix that is not /. When used it provides an important security improvement from AppArmor 3.0.

The plan is to uses attach_disconnect.path by default and automatically on all profiles with the attach_disconnect flag. The attached path is set to a @{att}, a new dynamically generated variable set at build time in the preamble of all profile to be:

• @{att}=/att/<profile_name> for profile with attach_disconnect flag.
• @{att}=/ for other profiles
• When the feature is disabled (for abi3), the variable is defined as a global tunable and set to @{att}=/

Internal

• New abstractions/attached/base abstraction
• New abstractions/attached/consoles abstraction
• New attach build tasks:
  • Add the attach_disconnected.path flag on all profile with the attach_disconnected flag
  • Add the attached/base abstraction in the profile
• Fallback for ABI3: globally defined @{att}=/

Tasks

• [ ] Ensure all profiles with attach_disconnect have been updated to use @{att} when required.
• [x] Compatibility issue with abi3:

  • 558

  • 557

  • 555

[curiosityseeker]

The plan is to uses attach_disconnect.path by default and automatically on all profiles with the attach_disconnect flag. The attached path is set to a @{att}, a new dynamically generated variable set at build time in the preamble of all profile to be:

* `@{att}=/att/<profile_name>` for profile with `attach_disconnect` flag.

* `@{att}=/` for other profiles

This is what I don't understand. @{att}=/att/<profile_name> is for profiles with the attach_disconnect flag - okay. But @{att}=/ for other profiles, i.e. without the attach_disconnect flag? Why should this be needed for such profiles at all? That sounds to me like a oxymoron :)

[roddhjav]

As @{att} can be used in abstraction, profile without the attach_disconnect flag need to have the variable defined. It is mostly a safety measure to ensure the profiles compile.

[curiosityseeker]

Ah, understood! Thanks!

[beroal]

As @{att} can be used in abstraction, profile without the attach_disconnect flag need to have the variable defined. It is mostly a safety measure to ensure the profiles compile.

Why not @{att}=/giekxhayfnjdhaeb?