Isolating apps by remapping paths

[dundalek]

I've been experimenting with user-defined sandboxing using Bubblewrap process wrapper.

I would like to try AppArmor, it seems better to use LSM as a proper solution designed for security instead of bending container mechanisms for security. Another reason is that with process wrappers it is possible to bypass the sandbox by mistake by executing without the wrapper.

However, I found useful to be able to isolate apps by remapping paths (uses bind mounts).
For example coding agents like claude-code or gemini-cli manage their own NPM installation, so npm install dirs need to be writable, but we want to seprate them to make sure code written in one sandbox does not get executed in another sandbox.
Example how it works in Bubblewrap: --bind /home/user/sandboxes/foo /home/user.

Is it possible to achive this with AppArmor? I see there are mount rules, but those seem to be only for allowing syscalls but they do not actually perform those syscalls.

If not is it a good fit to have a wrapper script that would setup the mounts in combination with AppArmor?

Or would there be completely different way how to achieve such isolation?

[roddhjav]

Apparmor is only allowing / denying things.

Setting up a sandbox, putting a container image in this sandbox and pivoting the root to this image (like snap, flatpak or docker do) is out of the scope of apparmor. However, in coordination with these sandbox manager, you can use apparmor to ensure sandbox escape is not possible. It is especially useful when you need to give access to devices file (graphics, usb...) to the sandbox.

[dundalek]

Thanks for the response, that makes sense.

I believe Snap does use AppArmor internally, but bundling concerns of distribution and runtime makes it more complex, which increases attack surface and risk of misconfiguration.

But I like the idea of complementing with the sandbox manager. I could try keep using Bubblewrap, but have AppArmor under for the extra layer of security. I will give that a try.

[roddhjav]

Well, I have been experimenting with flatpak and apparmor; there are some challenges...

[dundalek]

Flatpak uses Bubblewrap internally, so there will likely be an overlap of challenges, things like XDG portals, D-BUS filtering, etc. I like that architecture+implementation more than Snap or Docker.