We're disabling symlink traversal inf /var.  Currently, cups makes symlinks for PPDs in /var/spool rather than copying them.  The efficiency gain here is relatively small since PPDs aren't very large and we're not very sensitive to latency anyway.  I'm going to patch it out.