Re: [gentoo-dev] Overriding the sandbox, or ...

["Chad M. Huneycutt" <chad.huneycutt@acm.org>]

monkey wrote:
> ... how can I get something installed in /usr/sbin? This will probably
> open up a can of worms, but here I go. I want to change the ebuild for
> iptables-1.2.6a to install with the prefix "/usr". Why, well I feel that
> it is more FHS-compliant since the reasoning in the ebuild states that
> things were moved back to /sbin and /lib to help people with netmounted
> /usr systems get things working properly. I take exception to that on two
> points: one, iptables is firewalling code and nothing more, and two, no
> firewall should have netmounted systems. The FHS recommends keeping / as
> free of things as possible. Only applications needed to repair filesystems
> and get simple communication going are recommended for install in /. Since
> no firewall should have any netmounted filesystems, I don't see the
> validity in the argument for moving everything into /sbin and /lib.
> However, changing the ebuild to fix this results in a "sandbox violation"
> and the emerge fails. So, how can I bypass the sandbox for my iptables
> install? This is not a swipe at the maintainer, I just have a different 
> opinion of where I want my userspace firewall code to live. Thanks for any 
> pointers.

I don't understand.  Why can't you just change whatever it is in the 
iptables ebuild that specifies prefix=/ to prefix=/usr ? (this may require 
changing more than just the ./configure stuff).  You didn't say exactly 
what you are trying to do to effect this, but it must be wrong.  You will 
only get sandbox violations if you try to install stuff outside the sandbox 
before the merge stage, and that is always wrong (unless you have a darn 
good reason).  Remember that first the iptables stuff will be installed to 
${D}/usr/sbin and ${D}/usr/lib, and then will be merged into the real file 
system.

Chad (chadh@gentoo.org)