Now that we got the ball rolling on transitioning to journald, we might have a better chance to get rid of symlinks in /var/log and block symlink traversal in that subtree as well (there's currently an exception configured for /var/log: https://chromium.git.corp.google.com/chromiumos/platform2/+/1e10ab6f7be6b947f5fa54b93950b850f056c0ff/init/chromeos_startup#420 )