From: aranea@aixah.de (Luis Ressel) Date: Sat, 1 Feb 2014 12:53:16 +0100 Subject: [refpolicy] [PATCH 1/3] Allow mount_t to follow mount_loopback_t symlinks In-Reply-To: <52EC69CF.3060408@tresys.com> References: <1391035512-25441-1-git-send-email-aranea@aixah.de> <1391035512-25441-2-git-send-email-aranea@aixah.de> <52EC69CF.3060408@tresys.com> Message-ID: <20140201125316.384fce10@gentp.lnet> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On Fri, 31 Jan 2014 22:28:15 -0500 "Christopher J. PeBenito" wrote: > We generally prefer not to specially label symlinks. They don't have > the security properties of the object the point to, and the > permissions are checked normally on the target. My application case is that I'm mounting a regularily updated squashfs image. The filename of this image includes a timestamp, so I'm using a symlink; otherwise I'd have to update fstab each time the filename changes. I understand that labeling symlinks is uncommon, but in this particular case it seems like the best solution. The change clearly doesn't harm security, so I choose to push it upstream. Perhaps others are also using this scheme, but I'm sure it's not too common, so I'd also be okay with just applying this patch locally. -- Luis Ressel GPG fpr: F08D 2AF6 655E 25DE 52BC E53D 08F5 7F90 3029 B5BD -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 966 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140201/52667ce1/attachment.bin