On Wed, Oct 03, 2007 at 03:23:15PM -0700, Casey Schaufler wrote:
4. mount --bind /moldy /smack/tmp
or add
/moldy /smack/tmp none bind,rw 0 2
to /etc/fstab (same effect as (4))
Compare with your variant; the difference is in one argument of ln(1) and
one additional line in rc script or /etc/fstab. Sorry, but I don't buy
the "extra setup complexity" argument at all.
It's not about symlink pointing to /smack/<something>; it's about the place
where /smack/<something> itself points to. And _that_ can bloody well be
different in different chroots.
Look, if you allow to change where it goes, you certainly allow different
prefices on different boxen; moreover, admin can change it freely according
to his layout on given box. OTOH, you _can't_ have it different in different
chroots and changing it in one will affect all of them. See why that's a
problem?
Fixed-contents symlink (with or without variable tail - it's irrelevant
here) is a bloody wrong tool for that kind of fs for the reasons described
above. And if you go for "prefix should point to location on the same fs"
you can trivially configure the rest in userland (one line describing a
binding), leaving the kernel-side stuff with something like "userland
can ask for a pair of symlink and directory, having symlink resolve
to directory + <label>" instead of your "userland can ask for a symlink
resolving to <prefix> + <label>". And _that_ is chroot-neutral - you don't
need to do any extra work...
... like that one. Leave it to normal userland mechanisms; it's a matter
of a single line in whatever script you are using to set chroot up and it
involves _way_ fewer caveats.
That said, Alan's point still stands - if you don't get processes changing
context back and forth, you don't need anything at all - we already have
all we need for that kind of setups (and no, selinux is not involved ;-).
-
