Merge branch 'schroot-1.4' into schroot-squeeze-backport

Conflicts:
	debian/changelog

30 files changed, 366 insertions, 65 deletions

diff --git a/NEWS b/NEWS
index 2d57686f..3260f115 100644
--- a/NEWS
+++ b/NEWS
@@ -1,12 +1,32 @@
 NEWS                                                            -*- outline -*-
 ----
 
-Welcome to schroot 1.4.24.  Please read these release notes carefully.
+Welcome to schroot 1.4.27.  Please read these release notes carefully.
 
 Full installation instructions are provided in the INSTALL file.  The
 README file also contains more specific notes regarding building and
 configuration.
 
+* Major changes in 1.4.27:
+
+  1) Canonicalise symlink mount points.  If a mount point in fstab
+     contains a path with symlinks as mountpoint, canonicalise the
+     path, and ensure that absolute paths are mounted inside the
+     chroot.  The canonicalisation is performed on the host rather
+     than inside the chroot, so complex paths containing multiple
+     symlinks may not resolve correctly; but in the simple case of a
+     single link will resolve paths accurately.
+
+* Major changes in 1.4.26:
+
+  1) Added --exclude-aliases option.  This removes aliases from the
+     chroot selection.
+
+* Major changes in 1.4.25:
+
+  1) Support for overlayfs has been added in addition to the existing
+     aufs and unionfs support.
+
 * Major changes in 1.4.24:
 
   1) Support for zip file archives has been removed.  zip was not able
diff --git a/bin/schroot-mount/schroot-mount-main.cc b/bin/schroot-mount/schroot-mount-main.cc
index 5016f07d..487acc5c 100644
--- a/bin/schroot-mount/schroot-mount-main.cc
+++ b/bin/schroot-mount/schroot-mount-main.cc
@@ -19,6 +19,7 @@
 #include <config.h>
 
 #include <sbuild/sbuild-mntstream.h>
+#include <sbuild/sbuild-util.h>
 
 #include "schroot-mount-main.h"
 
@@ -59,7 +60,8 @@ namespace
       emap(main::CHILD_FORK, N_("Failed to fork child")),
       emap(main::CHILD_WAIT, N_("Wait for child failed")),
       // TRANSLATORS: %1% = command name
-      emap(main::EXEC,       N_("Failed to execute '%1%'"))
+      emap(main::EXEC,       N_("Failed to execute '%1%'")),
+      emap(main::REALPATH,   N_("Failed to resolve path '%1%'"))
     };
 
 }
@@ -85,6 +87,69 @@ main::~main ()
 {
 }
 
+std::string
+main::resolve_path (std::string const& mountpoint)
+{
+  // Ensure entry has a leading / to prevent security hole where
+  // mountpoint might be outside the chroot.
+  std::string absmountpoint(mountpoint);
+  if (absmountpoint.empty() || absmountpoint[0] != '/')
+    absmountpoint = std::string("/") + absmountpoint;
+
+  char *resolved_path = realpath(opts->mountpoint.c_str(), 0);
+  if (!resolved_path)
+    throw error(opts->mountpoint, REALPATH, strerror(errno));
+  std::string basepath(resolved_path);
+  std::free(resolved_path);
+
+  std::string directory(opts->mountpoint + absmountpoint);
+  // Canonicalise path to remove any symlinks.
+  resolved_path = realpath(directory.c_str(), 0);
+  if (resolved_path == 0)
+    {
+      // The path is either not present or is an invalid link.  If
+      // it's not present, we'll create it later.  If it's a link,
+      // bail out now.
+      bool link = false;
+      try
+	{
+	  if (sbuild::stat(directory, true).is_link())
+	    link = true;
+	}
+      catch (...)
+	{} // Does not exist, not a link
+
+      if (link)
+	throw error(directory, REALPATH, strerror(ENOTDIR));
+      else
+	{
+	  // Try validating the parent directory.
+	  sbuild::string_list dirs = sbuild::split_string(mountpoint, "/");
+	  if (dirs.size() > 1) // Recurse if possible, otherwise continue
+	    {
+	      std::string saveddir = *dirs.rbegin();
+	      dirs.pop_back();
+
+	      std::string newpath(resolve_path(sbuild::string_list_to_string(dirs, "/")));
+	      directory = newpath + "/" + saveddir;
+	    }
+	}
+    }
+  else
+    {
+      directory = resolved_path;
+      std::free(resolved_path);
+    }
+  // If the link was absolute (i.e. points somewhere on the host,
+  // outside the chroot, make sure that this is modified to be
+  // inside.
+  if (directory.size() < basepath.size() ||
+      directory.substr(0,basepath.size()) != basepath)
+    directory = basepath + directory;
+
+  return directory;
+}
+
 void
 main::action_mount ()
 {
@@ -95,13 +160,7 @@ main::action_mount ()
 
   while (mounts >> entry)
     {
-      // Ensure entry has a leading / to prevent security hole where
-      // mountpoint might be outside the chroot.
-      std::string d = entry.directory;
-      if (d.empty() || d[0] != '/')
-	d = std::string("/") + d;
-
-      std::string directory(opts->mountpoint + entry.directory);
+      std::string directory = resolve_path(entry.directory);
 
       if (!boost::filesystem::exists(directory))
 	{
diff --git a/bin/schroot-mount/schroot-mount-main.h b/bin/schroot-mount/schroot-mount-main.h
index f8a66183..2bcaa54c 100644
--- a/bin/schroot-mount/schroot-mount-main.h
+++ b/bin/schroot-mount/schroot-mount-main.h
@@ -42,7 +42,8 @@ namespace schroot_mount
       {
 	CHILD_FORK, ///< Failed to fork child.
 	CHILD_WAIT, ///< Wait for child failed.
-	EXEC        ///< Failed to execute.
+	EXEC,       ///< Failed to execute.
+	REALPATH    ///< Failed to resolve path.
       };
 
     /// Exception type.
@@ -80,6 +81,20 @@ namespace schroot_mount
 	      sbuild::environment const& env);
 
     /**
+     * Ensure that the mountpoint is a valid absolute path inside the
+     * chroot.  This is to avoid absolute or relative symlinks
+     * pointing outside the chroot causing filesystems to be mounted
+     * on the host.  An exception will be thrown if it is not possible
+     * to resolve the path.
+     *
+     * @param mountpoint the mountpoint to check,
+     * @returns the validated path.
+     */
+
+    std::string
+    resolve_path (std::string const& mountpoint);
+
+    /**
      * Wait for a child process to complete, and check its exit status.
      *
      * An error will be thrown on failure.
diff --git a/bin/schroot/schroot-main-base.cc b/bin/schroot/schroot-main-base.cc
index e49aab72..26d2df7a 100644
--- a/bin/schroot/schroot-main-base.cc
+++ b/bin/schroot/schroot-main-base.cc
@@ -147,7 +147,8 @@ main_base::get_chroot_options ()
       if (this->options->all_chroots)
 	{
 	  sbuild::string_list chroots;
-	  if (this->options->action == options_base::ACTION_LIST)
+	  if (this->options->action == options_base::ACTION_LIST &&
+	      !this->options->exclude_aliases)
 	    chroots = this->config->get_alias_list("chroot");
 	  else
 	    chroots = this->config->get_chroot_list("chroot");
@@ -156,7 +157,8 @@ main_base::get_chroot_options ()
       if (this->options->all_sessions)
 	{
 	  sbuild::string_list sessions;
-	  if (this->options->action == options_base::ACTION_LIST)
+	  if (this->options->action == options_base::ACTION_LIST &&
+	      !this->options->exclude_aliases)
 	    sessions = this->config->get_alias_list("session");
 	  else
 	    sessions = this->config->get_chroot_list("session");
@@ -165,7 +167,8 @@ main_base::get_chroot_options ()
       if (this->options->all_source_chroots)
 	{
 	  sbuild::string_list sources;
-	  if (this->options->action == options_base::ACTION_LIST)
+	  if (this->options->action == options_base::ACTION_LIST &&
+	      !this->options->exclude_aliases)
 	    sources = this->config->get_alias_list("source");
 	  else
 	    sources = this->config->get_chroot_list("source");
@@ -281,7 +284,7 @@ main_base::run_impl ()
 	throw error(*pos, CHROOT_NOTFOUND);
     }
 
-  /* Print chroot list (including aliases). */
+  /* Print chroot list. */
   if (this->options->action == options_base::ACTION_LIST)
     {
       action_list();
diff --git a/bin/schroot/schroot-options-base.cc b/bin/schroot/schroot-options-base.cc
index 6d17af32..32848cca 100644
--- a/bin/schroot/schroot-options-base.cc
+++ b/bin/schroot/schroot-options-base.cc
@@ -54,6 +54,7 @@ options_base::options_base ():
   all_chroots(false),
   all_sessions(false),
   all_source_chroots(false),
+  exclude_aliases(false),
   session_name(),
   session_force(false),
   chroot(_("Chroot selection")),
diff --git a/bin/schroot/schroot-options-base.h b/bin/schroot/schroot-options-base.h
index c4af6c31..fd568424 100644
--- a/bin/schroot/schroot-options-base.h
+++ b/bin/schroot/schroot-options-base.h
@@ -97,6 +97,8 @@ namespace schroot
     bool                 all_sessions;
     /// Use all source_chroots.
     bool                 all_source_chroots;
+    /// Exclude aliases in output.
+    bool                 exclude_aliases;
     /// Load chroots.
     bool                 load_chroots;
     /// Load sessions.
diff --git a/bin/schroot/schroot-options.cc b/bin/schroot/schroot-options.cc
index 0814f140..6c451be1 100644
--- a/bin/schroot/schroot-options.cc
+++ b/bin/schroot/schroot-options.cc
@@ -59,7 +59,9 @@ options::add_options ()
     ("all-sessions",
      _("Select all active sessions"))
     ("all-source-chroots",
-     _("Select all source chroots"));
+     _("Select all source chroots"))
+    ("exclude-aliases",
+     _("Do not include aliases"));
 
   chrootenv.add_options()
     ("directory,d", opt::value<std::string>(&this->directory),
@@ -106,6 +108,8 @@ options::check_options ()
     this->all_sessions = true;
   if (vm.count("all-source-chroots"))
     this->all_source_chroots = true;
+  if (vm.count("exclude-aliases"))
+    this->exclude_aliases = true;
 
   if (vm.count("preserve-environment"))
     this->preserve = true;
diff --git a/debian/changelog b/debian/changelog
index c0c17ff2..6a5ea8b5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,39 @@
+schroot (1.4.27-1) unstable; urgency=low
+
+  * New upstream stable release.
+  * 10mount: Use secure lock directory /var/lock/schroot in place
+    of insecure use of lockfiles directly in /var/lock.
+  * schroot-mount: Canonicalise mountpoints with symlinks to avoid
+    mounting absolute paths on the host rather than inside the chroot
+    (Closes: #686148).  Note the caveat regarding paths with multiple
+    symlinks in schroot-script-config(5).
+
+ -- Roger Leigh <rleigh@debian.org>  Mon, 29 Oct 2012 20:13:36 +0000
+
+schroot (1.4.26-1) unstable; urgency=low
+
+  * Upgrade to Standards Version 3.9.3.
+  * Updated translations:
+    - da (Closes: #658517).  Thanks to Joe Hansen.
+    - de (Closes: #659523).  Thanks to Holger Wansing.
+    - fr (Closes: #661512).  Thanks to Thomas Blein.
+    - pt (Closes: #660040).  Thanks to Pedro Ribeiro.
+    - zh_CN (Closes: #659875).  Thanks to Ji ZhengYu. 
+  * Added --exclude-aliases option.  This removes aliases from the
+    chroot selection.
+
+ -- Roger Leigh <rleigh@debian.org>  Sat, 12 May 2012 15:57:33 +0100
+
+schroot (1.4.25-1) unstable; urgency=low
+
+  * New upstream stable release.
+  * Build-Depend on generic Boost pacakges, to build against v1.48.
+  * Support for overlayfs has been added in addition to aufs and
+    unionfs (Closes: #648450).  Thanks to Evan Broder.  Backported
+    from schroot-1.5.2.
+
+ -- Roger Leigh <rleigh@debian.org>  Fri, 03 Feb 2012 10:56:57 +0000
+
 schroot (1.4.24-1~bpo60+1) squeeze-backports; urgency=low
 
   * Rebuild for squeeze-backports.
diff --git a/debian/control b/debian/control
index 77864473..55012ddd 100644
--- a/debian/control
+++ b/debian/control
@@ -5,7 +5,7 @@ Maintainer: Debian buildd-tools Developers <buildd-tools-devel@lists.alioth.debi
 Uploaders: Roger Leigh <rleigh@debian.org>
 Build-Depends: debhelper (>= 9), autotools-dev, pkg-config, libpam0g-dev, uuid-dev [!kfreebsd-any], liblockdev1-dev, libboost-dev, libboost-iostreams-dev, libboost-program-options-dev, libboost-regex-dev, libboost-filesystem-dev, gettext, libcppunit-dev, groff-base
 Build-Depends-Indep: doxygen, graphviz
-Standards-Version: 3.9.2
+Standards-Version: 3.9.3
 Vcs-Browser: http://git.debian.org/?p=buildd-tools/schroot.git
 Vcs-Git: git://git.debian.org/git/buildd-tools/schroot
 
diff --git a/debian/schroot.init b/debian/schroot.init
index 7cacf2c0..9f104d20 100755
--- a/debian/schroot.init
+++ b/debian/schroot.init
@@ -70,6 +70,20 @@ end_sessions()
 
 case "$1" in
     start|restart|force-reload)
+	# Delete /var/lock/schroot if it's not root:root 0700, or if
+	# it's not a directory.
+	if [ -e /var/lock/schroot ]; then
+	    if [ "$(stat -c "%u %g %a" /var/lock/schroot)" != "0 0 700" ]; then
+		rm -rf /var/lock/schroot
+	    fi
+	    if [ ! -d /var/lock/schroot ]; then
+		rm -rf /var/lock/schroot
+	    fi
+	fi
+	if [ ! -d /var/lock/schroot ]; then
+	    mkdir -m 0700 /var/lock/schroot
+	fi
+
         if [ "$SESSIONS_RECOVER" = "end" ] ; then
             end_sessions
 	else
diff --git a/debian/schroot.postinst b/debian/schroot.postinst
index e73c16c6..4a2b0dfd 100644
--- a/debian/schroot.postinst
+++ b/debian/schroot.postinst
@@ -56,6 +56,22 @@ if dpkg --compare-versions "$2" le "1.4.1-1"; then
 	"/etc/schroot/nssdatabases-defaults"
 fi
 
+if dpkg --compare-versions "$2" lt "1.4.27-1"; then
+    # Delete /var/lock/schroot if it's not root:root 0700, or if
+    # it's not a directory.
+    if [ -e /var/lock/schroot ]; then
+	if [ "$(stat -c "%u %g %a" /var/lock/schroot)" != "0 0 700" ]; then
+	    rm -rf /var/lock/schroot
+	fi
+	if [ ! -d /var/lock/schroot ]; then
+	    rm -rf /var/lock/schroot
+	fi
+    fi
+    if [ ! -d /var/lock/schroot ]; then
+	mkdir -m 0700 /var/lock/schroot
+    fi
+fi
+
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.
 
diff --git a/etc/setup.d/10mount b/etc/setup.d/10mount
index 29636d11..5e0b0af0 100755
--- a/etc/setup.d/10mount
+++ b/etc/setup.d/10mount
@@ -64,6 +64,20 @@ do_umount_all()
 	# Note that this does not prevent the problem when programs
 	# other than schroot mount and unmount filesystems (since they
 	# don't create the lock).
+	if [ -e /var/lock/schroot ]; then
+	    if [ ! -d /var/lock/schroot ]; then
+		error "/var/lock/schroot is not a directory"
+		exit 1
+	    fi
+	else
+	    mkdir -m 0700 /var/lock/schroot
+	fi
+
+	if [ "$(stat -c "%u %g %a" /var/lock/schroot)" != "0 0 700" ]; then
+	    error "/var/lock/schroot is not owned by root:root, or lacks 0700 permissions"
+	    exit 1
+	fi
+
 	( flock 9
 	    mounts="$("$LIBEXEC_DIR/schroot-listmounts" -m "$1")"
 	    if [ "x$mounts" != 'x' ]; then
@@ -73,7 +87,7 @@ do_umount_all()
 		    umount "$mountloc" || exit 1
 		done || exit 1
 	    fi
-	) 9>"/var/lock/schroot-umount"
+	) 9>"/var/lock/schroot/umount"
     else
 	warn "Mount location $1 no longer exists; skipping unmount"
     fi
@@ -92,6 +106,9 @@ do_mount_fs_union()
 	    aufs)
 		CHROOT_UNION_MOUNT_OPTIONS="br:${CHROOT_UNION_OVERLAY_DIRECTORY}:${CHROOT_UNION_UNDERLAY_DIRECTORY}=ro"
 		;;
+	    overlayfs)
+                CHROOT_UNION_MOUNT_OPTIONS="lowerdir=${CHROOT_UNION_UNDERLAY_DIRECTORY},upperdir=${CHROOT_UNION_OVERLAY_DIRECTORY}"
+                ;;
 	esac
     fi
 
diff --git a/man/schroot-script-config.5.man b/man/schroot-script-config.5.man
index 1ec89e16..69290de8 100644
--- a/man/schroot-script-config.5.man
+++ b/man/schroot-script-config.5.man
@@ -45,7 +45,10 @@ The filesystem table file to be used to mount filesystems within the chroot.
 The format of this file is the same as for \fI/etc/fstab\fP, documented in
 .BR fstab (5).
 The only difference is that the mountpoint path \fIfs_dir\fP is relative to the
-chroot, rather than the root.
+chroot, rather than the root.  Also note that mountpoints are canonicalised on
+the host, which will ensure that absolute symlinks point inside the chroot, but
+complex paths containing multiple symlinks may be resolved incorrectly; it is
+advised to not use nested symlinks as mountpoints.
 .TP
 NSSDATABASES
 A file listing the system databases to copy into the chroot.  The default
diff --git a/man/schroot.1.man b/man/schroot.1.man
index 24d59321..aba9a303 100644
--- a/man/schroot.1.man
+++ b/man/schroot.1.man
@@ -35,6 +35,7 @@ schroot \- securely enter a chroot environment
 .RB [ \-q \[or] \-\-quiet " \[or] " \-v \[or] \-\-verbose ]
 .RB [ "\-c \fIchroot\fP" \[or] "\-\-chroot=\fIchroot\fP"
 .RB " \[or] " \-\-all " \[or] " \-\-all\-chroots " \[or] " \-\-all\-source\-chroots " \[or] " \-\-all\-sessions ]
+.RB " \[or] " \-\-exclude\-aliases
 .RB [ \-\- ]
 .RB [ COMMAND " [ " ARG1 " [ " ARG2 " [ " ARGn ]]]]
 .SH DESCRIPTION
@@ -156,6 +157,10 @@ and source chroots are not considered.
 .BR \-\-all\-source\-chroots
 Select all source chroots.  Identical to \fI\-\-all\fP, except that chroots
 and sessions are not considered.
+.TP
+.BR \-\-exclude\-aliases
+Do not select aliases in addition to chroots.  This ensures that only real
+chroots are selected, and are only listed once.
 .SS Chroot environment
 .TP
 .BR \-d ", " \-\-directory=\fIdirectory\fP
diff --git a/man/schroot.conf.5.man b/man/schroot.conf.5.man
index 63841e9a..bcc830d8 100644
--- a/man/schroot.conf.5.man
+++ b/man/schroot.conf.5.man
@@ -375,15 +375,15 @@ optional.
 .TP
 \f[CBI]union\-type=\fP\f[CI]type\fP
 Set the union filesystem type.  Currently supported filesystems are
-\[oq]aufs\[cq] and \[oq]unionfs\[cq].  The default is \[oq]none\[cq], which
-disables this feature.
+\[oq]aufs\[cq], \[oq]overlayfs\[cq] and \[oq]unionfs\[cq].  The default is
+\[oq]none\[cq], which disables this feature.
 .TP
 \f[CBI]union\-mount\-options=\fP\f[CI]options\fP
 Union filesystem mount options (branch configuration), used for mounting the
 union filesystem specified with \fIunion\-type\fP.  This replaces the complete
 \[lq]\-o\[rq] string for mount and allows for the creation of complex
-filesystem unions.  Note that \[oq]aufs\[cq] and \[oq]unionfs\[cq] have
-different supported mount options.
+filesystem unions.  Note that \[oq]aufs\[cq], \[oq]overlayfs\[cq] and
+\[oq]unionfs\[cq] each have different supported mount options.
 .B Note:
 One can use the variables \[lq]${CHROOT_UNION_OVERLAY_DIRECTORY}\[rq] and
 \[lq]${CHROOT_UNION_UNDERLAY_DIRECTORY}\[rq] to refer to the writable overlay
diff --git a/po/cs.po b/po/cs.po
index 57ad10e7..2ee1dd67 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: schroot\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
 "PO-Revision-Date: 2010-07-11 18:39+0200\n"
 "Last-Translator: Miroslav Kure <kurem@debian.cz>\n"
 "Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
@@ -460,6 +460,10 @@ msgstr "Čekání na potomka selhalo"
 msgid "Failed to execute '%1%'"
 msgstr "Nepodařilo se spustit „%1%“"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Nepodařilo se nastavit skupinu „%1%“"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -609,6 +613,9 @@ msgstr "Vybere všechna aktivní sezení"
 msgid "Select all source chroots"
 msgstr "Vybere všechna chroot prostředí"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Uživatelské jméno (implicitně aktuální uživatel)"
 
diff --git a/po/da.po b/po/da.po
index 54ac1164..69458b66 100644
--- a/po/da.po
+++ b/po/da.po
@@ -1,7 +1,7 @@
 # Danish translation schroot.
-# Copyright (C) 2010 Roger Leigh <rleigh@debian.org> & Joe Hansen.
+# Copyright (C) 2012 Roger Leigh <rleigh@debian.org> & Joe Hansen.
 # This file is distributed under the same license as the schroot package.
-# Joe Hansen <joedalton2@yahoo.dk>, 2010.
+# Joe Hansen <joedalton2@yahoo.dk>, 2010, 2012.
 # Korrekturlæst Kenneth og Ask, 2010.
 #
 # build -> kompilere
@@ -18,8 +18,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: schroot\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
-"PO-Revision-Date: 2010-12-08 17:34+0000\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
+"PO-Revision-Date: 2012-02-02 17:34+0000\n"
 "Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
 "Language-Team: Danish <dansk@dansk-gruppen.dk>\n"
 "Language: da\n"
@@ -491,6 +491,10 @@ msgstr "Vent på underproces mislykkedes"
 msgid "Failed to execute '%1%'"
 msgstr "Kunne ikke køre '%1%'"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Kunne ikke angive gruppe '%1%'"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -638,6 +642,9 @@ msgstr "Vælg alle aktive sessioner"
 msgid "Select all source chroots"
 msgstr "Vælg alle kildechroot'er"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Brugernavn (forvalg er aktuelle bruger)"
 
@@ -807,7 +814,7 @@ msgid "Personality"
 msgstr "Personalitet"
 
 msgid "Original Chroot Name"
-msgstr ""
+msgstr "Oprindelig Chrootnavn"
 
 msgid "Session ID"
 msgstr "Session-id"
diff --git a/po/de.po b/po/de.po
index 59669ba3..d85c209d 100644
--- a/po/de.po
+++ b/po/de.po
@@ -3,14 +3,14 @@
 # This file is distributed under the same license as the schroot package.
 # Jens Seidel <jensseidel@users.sf.net>, 2006, 2008, 2009.
 # Helge Kreutzmann <debian@helgefjell.de>, 2009.
-# Holger Wansing <linux@wansing-online.de>, 2009, 2010.
+# Holger Wansing <linux@wansing-online.de>, 2009, 2010, 2012.
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: schroot 1.4.12-1\n"
+"Project-Id-Version: schroot 1.4.25-1\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
-"PO-Revision-Date: 2010-12-07 20:15+0100\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
+"PO-Revision-Date: 2012-02-11 21:14+0100\n"
 "Last-Translator: Holger Wansing <linux@wansing-online.de>\n"
 "Language-Team: German <debian-l10n-german@lists.debian.org>\n"
 "Language: de\n"
@@ -476,6 +476,10 @@ msgstr "Warten auf Kindprozess fehlgeschlagen"
 msgid "Failed to execute '%1%'"
 msgstr "Ausführung von »%1%« fehlgeschlagen"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Setzen von Gruppe »%1%« fehlgeschlagen"
+
 # CHECKME: stimmt "[OPTION …]" oder sollte es "[OPTIONEN …]" oder
 # "[OPTION…]" heißen?
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
@@ -626,6 +630,9 @@ msgstr "Alle aktiven Sitzungen auswählen"
 msgid "Select all source chroots"
 msgstr "Alle Quell-Chroots auswählen"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Benutzername (standardmäßig der aktuelle Benutzer)"
 
@@ -798,7 +805,7 @@ msgid "Personality"
 msgstr "Persönlichkeit"
 
 msgid "Original Chroot Name"
-msgstr ""
+msgstr "Original-Chroot-Name"
 
 msgid "Session ID"
 msgstr "Sitzungs-ID"
diff --git a/po/en.po b/po/en.po
index 9257d6ef..21e5789f 100644
--- a/po/en.po
+++ b/po/en.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: schroot 0.1.2\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
 "PO-Revision-Date: 2010-09-06 20:02+0100\n"
 "Last-Translator: Roger Leigh <rleigh@debian.org>\n"
 "Language-Team: English <rleigh@debian.org>\n"
@@ -456,6 +456,10 @@ msgstr "Wait for child failed"
 msgid "Failed to execute '%1%'"
 msgstr "Failed to execute ‘%1%’"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Failed to set group ‘%1%’"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -602,6 +606,9 @@ msgstr "Select all active sessions"
 msgid "Select all source chroots"
 msgstr "Select all source chroots"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Username (default current user)"
 
diff --git a/po/eu.po b/po/eu.po
index 4d7e0f21..282c23f7 100644
--- a/po/eu.po
+++ b/po/eu.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: eu\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
 "PO-Revision-Date: 2010-01-16 15:43+0000\n"
 "Last-Translator: Piarres Beobide <pi@beobide.net>\n"
 "Language-Team: Euskara <Librezale@librezale.org>\n"
@@ -483,6 +483,10 @@ msgstr "Huts umea itxoitean"
 msgid "Failed to execute '%1%'"
 msgstr "Huts egin du '%1%' exekutatzean"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Huts egin du '%1%' taldea ezartzean"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -630,6 +634,9 @@ msgstr "Saio aktibo guztiak hautatu"
 msgid "Select all source chroots"
 msgstr "Chroot guztiak hautatu"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Erabiltzailea (lehenetsia uneko erabiltzailea)"
 
diff --git a/po/fr.po b/po/fr.po
index 4dfe14c4..05ec2d94 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -1,22 +1,22 @@
 # Translation of schroot in French.
-# Copyright © 2006-2008, 2010 Debian French l10n team <debian-l10n-french@lists.debian.org>
+# Copyright © 2006-2008, 2010, 2012 Debian French l10n team <debian-l10n-french@lists.debian.org>
 # This file is distributed under the same license as the schroot package.
 #
 # Nicolas François <nicolas.francois@centraliens.net>, 2006-2008.
-# Thomas Blein <tblein@tblein.eu>, 2010.
+# Thomas Blein <tblein@tblein.eu>, 2010, 2012.
 msgid ""
 msgstr ""
 "Project-Id-Version: schroot\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
-"PO-Revision-Date: 2010-12-07 21:14+0100\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
+"PO-Revision-Date: 2012-02-03 22:06+0100\n"
 "Last-Translator: Thomas Blein <tblein@tblein.eu>\n"
 "Language-Team: French <debian-l10n-french@lists.debian.org>\n"
 "Language: fr\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Generator: Lokalize 1.0\n"
+"X-Generator: Lokalize 1.2\n"
 "Plural-Forms: nplurals=2; plural=(n > 1);\n"
 
 #. TRANSLATORS: %1% = file
@@ -482,6 +482,10 @@ msgstr "Échec lors de l'attente du fils"
 msgid "Failed to execute '%1%'"
 msgstr "Échec lors de l'exécution de « %1% »"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Échec lors du positionnement du groupe à « %1% »"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -628,6 +632,9 @@ msgstr "Sélectionner toutes les sessions actives"
 msgid "Select all source chroots"
 msgstr "Sélectionner toutes les sources de chroots"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Nom d'utilisateur (l'utilisateur courant par défaut)"
 
@@ -795,7 +802,7 @@ msgid "Personality"
 msgstr "Personnalité"
 
 msgid "Original Chroot Name"
-msgstr ""
+msgstr "Nom d'origine du chroot"
 
 msgid "Session ID"
 msgstr "Identifiant de session"
diff --git a/po/it.po b/po/it.po
index c687e1b3..b7af498b 100644
--- a/po/it.po
+++ b/po/it.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: schroot 1.4.16-1\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
 "PO-Revision-Date: 2010-12-07 20:01+0100\n"
 "Last-Translator: Vincenzo Campanella <vinz65@gmail.com>\n"
 "Language-Team: Italian <tp@lists.linux.it>\n"
@@ -474,6 +474,10 @@ msgstr "Attesa per il figlio non riuscita"
 msgid "Failed to execute '%1%'"
 msgstr "Esecuzione di «%1%» non riuscita"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Impossibile impostare il gruppo «%1%»"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -626,6 +630,9 @@ msgstr "Seleziona tutte le sessioni attive"
 msgid "Select all source chroots"
 msgstr "Seleziona tutti i chroot sorgente"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Nome utente (predefinito: l'utente attuale)"
 
diff --git a/po/pt.po b/po/pt.po
index 7c907a58..fc7e15f2 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -4,14 +4,14 @@
 #
 # Translations:
 # Miguel Figueiredo <elmig@debianpt.org>, 2006.
-# Pedro Ribeiro <p.m42.ribeiro@gmail.com>, 2010.
+# Pedro Ribeiro <p.m42.ribeiro@gmail.com>, 2010-2012.
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: schroot 1.4.8-1\n"
+"Project-Id-Version: schroot 1.4.25-1\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
-"PO-Revision-Date: 2010-09-08 23:50+0100\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
+"PO-Revision-Date: 2012-02-06 21:50+0100\n"
 "Last-Translator: Pedro Ribeiro <p.m42.ribeiro@gmail.com>\n"
 "Language-Team: Portuguese <traduz@debianpt.org>\n"
 "Language: pt\n"
@@ -468,6 +468,10 @@ msgstr "Espera pelo processo filho falhou"
 msgid "Failed to execute '%1%'"
 msgstr "Falhou a execução de '%1%'"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Falhou a definição do grupo '%1%'"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -614,6 +618,9 @@ msgstr "Seleccionar todas as sessões activas"
 msgid "Select all source chroots"
 msgstr "Seleccionar todos os chroots de origem"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Nome de utilizador (pré-definido para utilizador actual)"
 
@@ -782,7 +789,7 @@ msgid "Personality"
 msgstr "Personalidade"
 
 msgid "Original Chroot Name"
-msgstr ""
+msgstr "Nome original da Chroot"
 
 msgid "Session ID"
 msgstr "ID de Sessão"
@@ -893,7 +900,7 @@ msgid "Namespace separator '%1%' may not be used in a chroot name"
 msgstr "O separador de 'namespace' '%1%' não pode ser usado no nome de chroot."
 
 msgid "Naming restrictions are documented in schroot.conf(5)"
-msgstr ""
+msgstr "Restrições de nome estão documentadas no schroot.conf(5)"
 
 #, boost-format
 msgid "Namespace separator '%1%' may not be used in an alias name"
diff --git a/po/schroot.pot b/po/schroot.pot
index 90e7ad04..7581b878 100644
--- a/po/schroot.pot
+++ b/po/schroot.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -455,6 +455,10 @@ msgstr ""
 msgid "Failed to execute '%1%'"
 msgstr ""
 
+#, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr ""
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -599,6 +603,9 @@ msgstr ""
 msgid "Select all source chroots"
 msgstr ""
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr ""
 
diff --git a/po/sv.po b/po/sv.po
index 0c411d0e..24023a23 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: schroot\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
 "PO-Revision-Date: 2010-01-16 15:44+0000\n"
 "Last-Translator: Daniel Nylander <po@danielnylander.se>\n"
 "Language-Team: Swedish <tp-sv@listor.tp-sv.se>\n"
@@ -474,6 +474,10 @@ msgstr "Väntan på barnprocess misslyckades"
 msgid "Failed to execute '%1%'"
 msgstr "Misslyckades med att starta \"%1%\""
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Misslyckades med att ställa in gruppen \"%1%\""
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 #, fuzzy
@@ -626,6 +630,9 @@ msgstr "Välj alla aktiva sessioner"
 msgid "Select all source chroots"
 msgstr "Välj alla chroot"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Användarnamn (förval är nuvarande användare)"
 
diff --git a/po/vi.po b/po/vi.po
index d6f0a57b..521abbef 100644
--- a/po/vi.po
+++ b/po/vi.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: schroot 1.4.12-1\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
 "PO-Revision-Date: 2010-09-28 22:16+0930\n"
 "Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n"
 "Language-Team: Vietnamese <vi-VN@googlegroups.com>\n"
@@ -471,6 +471,10 @@ msgstr "Lỗi đợi tiến trình con"
 msgid "Failed to execute '%1%'"
 msgstr "Lỗi thực hiện « %1% »"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "Lỗi đặt nhóm « %1% »"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -618,6 +622,9 @@ msgstr "Chọn mọi phiên chạy hoạt động"
 msgid "Select all source chroots"
 msgstr "Chọn mọi chroot nguồn"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "Tên người dùng (người dùng hiện thời mặc định)"
 
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 2404a20b..ca85ceb7 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -1,14 +1,13 @@
 # Chinese translations for schroot package.
 # Copyright (C) 2008 Roger Leigh <rleigh@debian.org>
 # This file is distributed under the same license as the schroot package.
-# Ji ZhengYu <zhengyuji@gmail.com>, 2008, 2009, 2010.
-#
+# Ji ZhengYu <zhengyuji@gmail.com>, 2008, 2009, 2010, 2011, 2012
 msgid ""
 msgstr ""
-"Project-Id-Version: schroot VERSION\n"
+"Project-Id-Version: schroot 1.4.25-1\n"
 "Report-Msgid-Bugs-To: Roger Leigh <rleigh@debian.org>\n"
-"POT-Creation-Date: 2012-01-17 20:50+0000\n"
-"PO-Revision-Date: 2010-12-09 15:47+0800\n"
+"POT-Creation-Date: 2012-10-29 20:28+0000\n"
+"PO-Revision-Date: 2012-02-14 21:07+0800\n"
 "Last-Translator: Ji ZhengYu <zhengyuji@gmail.com>\n"
 "Language-Team: Chinese (simplified) <i18n-zh@googlegroups.com>\n"
 "Language: zh_CN\n"
@@ -456,6 +455,10 @@ msgstr "等待子进程出错"
 msgid "Failed to execute '%1%'"
 msgstr "无法运行“%1%”"
 
+#, fuzzy, boost-format
+msgid "Failed to resolve path '%1%'"
+msgstr "无法设置组 ID “%1%”"
+
 #. TRANSLATORS: '...' is an ellipsis e.g. U+2026,
 #. and '-' is an em-dash.
 msgid "[OPTION...] - mount filesystems"
@@ -600,6 +603,9 @@ msgstr "选中所有激活的会话"
 msgid "Select all source chroots"
 msgstr "选中所有chroots 源"
 
+msgid "Do not include aliases"
+msgstr ""
+
 msgid "Username (default current user)"
 msgstr "用户名(默认为当前用户)"
 
@@ -767,7 +773,7 @@ msgid "Personality"
 msgstr "进程私有空间"
 
 msgid "Original Chroot Name"
-msgstr ""
+msgstr "原 Chroot 名称"
 
 msgid "Session ID"
 msgstr "会话ID"
diff --git a/sbuild/sbuild-chroot-facet-union.cc b/sbuild/sbuild-chroot-facet-union.cc
index 81200248..9b62b938 100644
--- a/sbuild/sbuild-chroot-facet-union.cc
+++ b/sbuild/sbuild-chroot-facet-union.cc
@@ -150,6 +150,7 @@ void
 chroot_facet_union::set_union_type (std::string const& type)
 {
   if (type == "aufs" ||
+      type == "overlayfs" ||
       type == "unionfs" ||
       type == "none")
     this->union_type = type;
diff --git a/sbuild/sbuild-util.cc b/sbuild/sbuild-util.cc
index 06358674..168e24b7 100644
--- a/sbuild/sbuild-util.cc
+++ b/sbuild/sbuild-util.cc
@@ -504,24 +504,42 @@ sbuild::exec (std::string const& file,
   return status;
 }
 
-sbuild::stat::stat (const char *file):
+sbuild::stat::stat (const char *file,
+		    bool        link):
   file(file),
   fd(0),
   errorno(0),
   status()
 {
-  if (::stat(file, &this->status) < 0)
-    this->errorno = errno;
+  if (link)
+    {
+      if (::lstat(file, &this->status) < 0)
+	this->errorno = errno;
+    }
+  else
+    {
+      if (::stat(file, &this->status) < 0)
+	this->errorno = errno;
+    }
 }
 
-sbuild::stat::stat (std::string const& file):
+sbuild::stat::stat (std::string const& file,
+		    bool               link):
   file(file),
   fd(0),
   errorno(0),
   status()
 {
-  if (::stat(file.c_str(), &this->status) < 0)
-    this->errorno = errno;
+  if (link)
+    {
+      if (::lstat(file.c_str(), &this->status) < 0)
+	this->errorno = errno;
+    }
+  else
+    {
+      if (::stat(file.c_str(), &this->status) < 0)
+	this->errorno = errno;
+    }
 }
 
 sbuild::stat::stat (std::string const& file,
diff --git a/sbuild/sbuild-util.h b/sbuild/sbuild-util.h
index cbf83e22..97491df6 100644
--- a/sbuild/sbuild-util.h
+++ b/sbuild/sbuild-util.h
@@ -369,14 +369,18 @@ namespace sbuild
     /**
      * The constructor.
      * @param file the filename to use.
+     * @param link use lstat rather than stat (i.e. don't follow symlinks).
      */
-    stat (const char *file);
+    stat (const char *file,
+	  bool        link = false);
 
     /**
      * The constructor.
      * @param file the filename to use.
+     * @param link use lstat rather than stat (i.e. don't follow symlinks).
      */
-    stat (std::string const& file);
+    stat (std::string const& file,
+	  bool               link = false);
 
     /**
      * The constructor.