You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
AppAmor 4.0 provides the attach_disconnect.path flag allowing to reattach this path to a prefix that is not /. When used it provides an important security improvement from AppArmor 3.0.
The plan is to uses attach_disconnect.path by default and automatically on all profiles with the attach_disconnect flag. The attached path is set to a @{att}, a new dynamically generated variable set at build time in the preamble of all profile to be:
@{att}=/att/<profile_name> for profile with attach_disconnect flag.
@{att}=/ for other profiles
When the feature is disabled (for abi3), the variable is defined as a global tunable and set to @{att}=/
Internal
New abstractions/attached/base abstraction
New abstractions/attached/consoles abstraction
New attach build tasks:
Add the attach_disconnected.path flag on all profile with the attach_disconnected flag
Add the attached/base abstraction in the profile
Fallback for ABI3: globally defined @{att}=/
Tasks
Ensure all profiles with attach_disconnect have been updated to use @{att} when required.
The plan is to uses attach_disconnect.path by default and automatically on all profiles with the attach_disconnect flag. The attached path is set to a @{att}, a new dynamically generated variable set at build time in the preamble of all profile to be:
* `@{att}=/att/<profile_name>` for profile with `attach_disconnect` flag.
* `@{att}=/` for other profiles
This is what I don't understand. @{att}=/att/<profile_name> is for profiles with the attach_disconnect flag - okay. But @{att}=/ for other profiles, i.e. without the attach_disconnect flag? Why should this be needed for such profiles at all? That sounds to me like a oxymoron :)
For more context, see https://apparmor.pujol.io/development/internal/#re-attached-path
AppAmor 4.0 provides the
attach_disconnect.path
flag allowing to reattach this path to a prefix that is not/
. When used it provides an important security improvement from AppArmor 3.0.The plan is to uses
attach_disconnect.path
by default and automatically on all profiles with theattach_disconnect
flag. The attached path is set to a@{att}
, a new dynamically generated variable set at build time in the preamble of all profile to be:@{att}=/att/<profile_name>
for profile withattach_disconnect
flag.@{att}=/
for other profiles@{att}=/
Internal
abstractions/attached/base
abstractionabstractions/attached/consoles
abstractionattach
build tasks:attach_disconnected.path
flag on all profile with theattach_disconnected
flagattached/base
abstraction in the profile@{att}=/
Tasks
attach_disconnect
have been updated to use@{att}
when required.The text was updated successfully, but these errors were encountered: