Yeah, very cool. It only works because the rootfs is mounted as read-only or else they might end up messing it up if the system was writing to the same block. But then again if it wasn't read-only this wouldn't be a problem.
A lot of the recent jailbreaks seem to depend on symlink shenanigans. I wonder why Apple can't simply remove symlink support from iOS' filesystem driver? Is there anything in iOS or the appstore apps that depend on it?
That's actually a lot less than I thought would be in the iOS filesystem.
It doesn't seem like it'd be incredibly hard to remove those symlinks. Although Apple would probably favor fixing the bugs that allow malicious symlinks rather than remove symlinks from their file system driver (the horror!)
They would also have to make sure no iOS applications make use of symlinks at any point. Since a ipa is simply a zip archive it's possible (and probable) that some applications already make use of symlinks on install or during operation. I think that's the major motivation.
Numerous App Store apps contain symlinks around the detached codesignature, most likely caused by changes over the years to the codesignature utility. Also in keeping with Xcode semantics, embedded frameworks often contain symlinks as well.
