In this lesson, you will learn how to use AppArmor path aliasing to securely map virtual, abstracted paths to their actual physical locations on your disk.
Understanding Path Aliases
In complex application deployments—such as containerized environments or systems using chroot jails—an application might expect its data to reside in a specific directory (e.g., /var/www/html), while your physical disk layout stores those files elsewhere (e.g., /mnt/data/web_content).
If you attempt to write a profile for the application, defining access to the physical path directly can be cumbersome, especially if the path changes across deployment stages. AppArmor allows you to define an alias rule, which acts as a redirect layer. When the kernel enforces the profile, it transparently translates the virtual path into the real, physical location, ensuring the security policy remains portable and clean.
Implementing Alias Rules
Alias rules are defined in your AppArmor configuration files (typically in /etc/apparmor.d/tunables/alias). The syntax is straightforward: alias <virtual_path> -> <physical_path>,.
For example, if you want your application to interact with /var/www/html while the files are physically stored in /mnt/ssd/production/web/, you would add the following to your configuration:
# /etc/apparmor.d/tunables/alias
alias /var/www/html/ -> /mnt/ssd/production/web/,
Once this alias is active, any rules you write in your application profile using /var/www/html/ are automatically mapped to the actual directory. If you later move your data to a new drive, you only need to update this single alias file rather than modifying every individual profile that references that directory.
Why This Matters
Using aliases keeps your profiles focused on what the application is doing rather than where the files are physically located. This decouples your security policy from your infrastructure layout, reducing the risk of "path bloat" in your profiles and making your security architecture much easier to audit and maintain as your environment scales.
Key Takeaway: Alias rules allow you to maintain clean, portable security profiles by transparently mapping virtual application paths to their physical disk locations.