Re: [gentoo-dev] Overriding the sandbox, or ...

[Vitaly Kushneriuk]

On Thu, 2002-04-18 at 00:44, monkey wrote:
> ... how can I get something installed in /usr/sbin? This will probably
> open up a can of worms, but here I go. I want to change the ebuild for
> iptables-1.2.6a to install with the prefix "/usr". Why, well I feel that
> it is more FHS-compliant since the reasoning in the ebuild states that
> things were moved back to /sbin and /lib to help people with netmounted
> /usr systems get things working properly. I take exception to that on two
> points: one, iptables is firewalling code and nothing more, and two, no
> firewall should have netmounted systems. The FHS recommends keeping / as
> free of things as possible. Only applications needed to repair filesystems
> and get simple communication going are recommended for install in /. Since
> no firewall should have any netmounted filesystems, I don't see the
> validity in the argument for moving everything into /sbin and /lib.
> However, changing the ebuild to fix this results in a "sandbox violation"
> and the emerge fails. So, how can I bypass the sandbox for my iptables
> install? This is not a swipe at the maintainer, I just have a different
> opinion of where I want my userspace firewall code to live. Thanks for any
> pointers.
>
> geoffrey

Now that's silly. You say that system that uses NFS does not need a
firewall? Wow ;). While iptables is a firewalling code it is not for a
"pure firewall" systems only. Pretty much every system should install at
least basic firewall, unless it's in a highly secure and trusted
environment with a good external firewall. And firewall should be
installed _before_ network comes up, so that there's no potential
opportunity window for an attack. That's why it should go to /sbin.
And this _is_ FHS compliant.

	/Vitaly.