[refpolicy] [PATCH 1/3] Allow mount_t to follow mount_loopback_t symlinks

[aranea@aixah.de (Luis Ressel)]

On Fri, 31 Jan 2014 22:28:15 -0500
"Christopher J. PeBenito" <cpebenito@tresys.com> wrote:

> We generally prefer not to specially label symlinks.  They don't have
> the security properties of the object the point to, and the
> permissions are checked normally on the target.

My application case is that I'm mounting a regularily updated squashfs
image. The filename of this image includes a timestamp, so I'm using a
symlink; otherwise I'd have to update fstab each time the filename
changes.

I understand that labeling symlinks is uncommon, but in this particular
case it seems like the best solution.

The change clearly doesn't harm security, so I choose to push it
upstream. Perhaps others are also using this scheme, but I'm sure it's
not too common, so I'd also be okay with just applying this patch
locally.


--
Luis Ressel <aranea@aixah.de>
GPG fpr: F08D 2AF6 655E 25DE 52BC  E53D 08F5 7F90 3029 B5BD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 966 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140201/52667ce1/attachment.bin