Thank you for your patience. Let me see if I can get my point across.
The intended Smack scenario:
1. Create /moldy at "_"
2. For each label you care about
2a. Create /moldy/<label>
2b. Set the label of /moldy/<label> to <label>
3. ln -s /smack/tmp /tmp
All processes are now redirected into the appropriate place
regardless of how they come into being. It doesn't matter if
the "session" starts from busybox, login, sshd, xdm, crontab,
or out of an init script.
Are you suggesting that /smack/tmp.link below is a mount point,
and that appropriate directories get mounted there?
1. Create /moldy at "_"
2. For each label you care about
2a. Create /moldy/<label>
2b. Set the label of /moldy/<label> to <label>
2c. mount --bind /moldy/<label> /smack/tmp.link/<label>
3. ln -s /smack/tmp.link /tmp
Now you sound like my daughter. :-)
It's the content of a symlink, and that can be just about anything
and is not required to point to anything, which is one reason why
I made that choice. If you don't have a /tmp, or can't write to the
/tmp that exists, or have a /tmp that's a dangling symlink under
any circumstances you may have an issue. That's true regardless of
the presence or absense of /smack. All of the traditional mechanisms
for dealing with /tmp in a chrooted or namespaced environment remain.
Nuts. That would have made addressing your concern easy.
It's in a symlink on the filesystem, and it doesn't have to be an
absolute pathname, although since it's a symlink and the semantics
for a symlink allow that be be absolute, relative, or dangling I
don't see any reason to restrict it from being absolute.
Could allowing multiple distinct mounts and symlink assignments
of /smackfs address those issues? I think it would, but as you pointed
out earlier, my lack of ability to read may be clouding my understanding.
Thank you.
Casey Schaufler
casey@schaufler-ca.com
-
