Finding symlink information in MAC Framework

[perryh at pluto.rain.com]

s <s at samu.pl> wrote:

> ... I am trying to compare the owner of the symlink to the owner
> of what the symlink points to ... At first I was trying to check
> wheter some user is trying to create such a symlink ...

I've always considered the "ownership" and "permissions" of a
symlink to be an artifact of the implementation, rather than
having any real significance.

Symlinks did not exist in Bell Labs Unix, at least as of
6th edition.  IIUC they were invented at UCB to get around
the limitation that a hard link could not cross a physical
filesystem boundary (i.e. a mount point); symlinks would
not have been needed had the entire logical filesystem been
contained on a single, unpartitioned physical device because
hard links could have been used instead.

A hard link has no ownership or permissions of its own:  it is
just an additional directory entry pointing to the same inode
as the target's original directory entry.  (The permissions are
stored in the inode, not in the directory entry.)

Because the target of a symlink is (in the general case) not
in the same physical filesystem as the symlink itself, the
symlink has to be stored in its own inode -- and that inode,
like any other, has "ownership" and "permission" fields which
will inevitably contain some pattern of bits -- but it's not
clear to me that anything is gained by assigning a meaning to
those patterns.

Getting back to the original problem, suppose you had no mounted
filesystems (other than special cases like devfs or /proc), the
entire logical filesystem tree being stored on a single device, so
that any file on the system could be hard-linked into any directory
on the system.  How would you detect that "some user" had created a
_hard_ link to some arbitrary file?