fix: harden read-only target diagnostics

internal/target/diagnostic.go

@@ -3,7 +3,6 @@ package target
 import (
 	"errors"
 	"io/fs"
-	"os"
 	"path/filepath"
 	"strings"
 
@@ -26,26 +25,66 @@ func ReadOnlyWriteAuthority(paths ...string) Check {
 	return check
 }
 
+// readOnlyWritablePath anchors traversal at an open root descriptor and refuses
+// symbolic links in every component. The authority observation therefore
+// cannot be redirected to a victim between path lookup steps, and it never
+// opens victim content or mutates filesystem metadata.
 func readOnlyWritablePath(path string) (bool, string) {
-	candidate := filepath.Clean(path)
-	for {
-		info, err := os.Stat(candidate)
-		if err == nil {
-			if !info.IsDir() {
-				candidate = filepath.Dir(candidate)
-			}
-			if err := unix.Access(candidate, unix.W_OK); err != nil {
-				return false, candidate + " is not writable: " + err.Error()
-			}
-			return true, candidate + " is writable"
-		}
-		if !errors.Is(err, fs.ErrNotExist) {
-			return false, candidate + " cannot be inspected: " + err.Error()
-		}
-		parent := filepath.Dir(candidate)
-		if parent == candidate {
-			return false, path + " has no writable existing ancestor"
-		}
-		candidate = parent
+	absolute, err := filepath.Abs(path)
+	if err != nil {
+		return false, path + " cannot be inspected: " + err.Error()
 	}
+	absolute = filepath.Clean(absolute)
+	components := strings.Split(strings.TrimPrefix(absolute, string(filepath.Separator)), string(filepath.Separator))
+	if len(components) == 1 && components[0] == "" {
+		components = nil
+	}
+
+	current, err := unix.Open(string(filepath.Separator), unix.O_PATH|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return false, absolute + " cannot be inspected: " + err.Error()
+	}
+	defer func() { _ = unix.Close(current) }()
+	currentPath := string(filepath.Separator)
+
+	for index, component := range components {
+		child, openErr := unix.Openat(current, component, unix.O_PATH|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+		if errors.Is(openErr, fs.ErrNotExist) {
+			return writableDirectory(current, currentPath, absolute)
+		}
+		if openErr != nil {
+			return false, filepath.Join(currentPath, component) + " cannot be inspected without following links: " + openErr.Error()
+		}
+		var stat unix.Stat_t
+		statErr := unix.Fstat(child, &stat)
+		if statErr != nil {
+			_ = unix.Close(child)
+			return false, filepath.Join(currentPath, component) + " cannot be inspected: " + statErr.Error()
+		}
+		kind := stat.Mode & unix.S_IFMT
+		componentPath := filepath.Join(currentPath, component)
+		if kind == unix.S_IFLNK {
+			_ = unix.Close(child)
+			return false, componentPath + " is a symbolic link and is unavailable for safe write observation"
+		}
+		if index == len(components)-1 {
+			_ = unix.Close(child)
+			return writableDirectory(current, currentPath, absolute)
+		}
+		if kind != unix.S_IFDIR {
+			_ = unix.Close(child)
+			return false, componentPath + " is not a directory"
+		}
+		_ = unix.Close(current)
+		current = child
+		currentPath = componentPath
+	}
+	return writableDirectory(current, currentPath, absolute)
+}
+
+func writableDirectory(descriptor int, directory, targetPath string) (bool, string) {
+	if err := unix.Faccessat(descriptor, ".", unix.W_OK|unix.X_OK, unix.AT_EACCESS); err != nil {
+		return false, directory + " is not writable for " + targetPath + ": " + err.Error()
+	}
+	return true, directory + " is writable for " + targetPath
 }

internal/target/diagnostic_test.go

@@ -0,0 +1,74 @@
+package target_test
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"proxyctl/internal/target"
+)
+
+func TestReadOnlyWriteAuthorityRejectsSymlinkedFinalAndAncestorWithoutTouchingVictim(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		path func(root, victim string) string
+	}{
+		{
+			name: "final path",
+			path: func(root, victim string) string {
+				link := filepath.Join(root, "managed.json")
+				if err := os.Symlink(victim, link); err != nil {
+					t.Fatal(err)
+				}
+				return link
+			},
+		},
+		{
+			name: "ancestor path",
+			path: func(root, victim string) string {
+				victimDir := filepath.Dir(victim)
+				link := filepath.Join(root, "managed")
+				if err := os.Symlink(victimDir, link); err != nil {
+					t.Fatal(err)
+				}
+				return filepath.Join(link, filepath.Base(victim))
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			root := t.TempDir()
+			victimDir := t.TempDir()
+			victim := filepath.Join(victimDir, "victim.json")
+			const content = "VICTIM-CONTENT-MUST-STAY"
+			if err := os.WriteFile(victim, []byte(content), 0o640); err != nil {
+				t.Fatal(err)
+			}
+			beforeContent, err := os.ReadFile(victim)
+			if err != nil {
+				t.Fatal(err)
+			}
+			before, err := os.Stat(victim)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			check := target.ReadOnlyWriteAuthority(test.path(root, victim))
+			if check.OK || (!strings.Contains(check.Evidence, "symbolic link") && !strings.Contains(check.Evidence, "symlink")) {
+				t.Fatalf("symlink path reported writable: %#v", check)
+			}
+			after, err := os.Stat(victim)
+			if err != nil {
+				t.Fatal(err)
+			}
+			data, err := os.ReadFile(victim)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(beforeContent) != content || string(data) != content || !reflect.DeepEqual(before.Sys(), after.Sys()) {
+				t.Fatalf("victim changed: before=%#v after=%#v content=%q", before, after, data)
+			}
+		})
+	}
+}