fix: reject profile diagnostic symlink ancestors

internal/profile/diagnostic.go

@@ -4,34 +4,18 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"io/fs"
-	"os"
-
-	"golang.org/x/sys/unix"
 )
 
 // ReadOnlyLoad reads and validates Profile configuration without creating,
 // chmodding, chowning, locking, or replacing any filesystem object.
 func (s *FileStore) ReadOnlyLoad() (State, error) {
-	file, err := os.OpenFile(s.path, unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK, 0)
+	data, err := s.secureStore().ReadFile(s.path)
 	if errors.Is(err, fs.ErrNotExist) {
 		return State{}, nil
 	}
 	if err != nil {
-		return State{}, fmt.Errorf("open Profile configuration read-only: %w", err)
-	}
-	defer file.Close()
-	info, err := file.Stat()
-	if err != nil {
-		return State{}, fmt.Errorf("inspect Profile configuration: %w", err)
-	}
-	if !info.Mode().IsRegular() {
-		return State{}, errors.New("Profile configuration is not a regular file")
-	}
-	data, err := io.ReadAll(file)
-	if err != nil {
-		return State{}, fmt.Errorf("read Profile configuration: %w", err)
+		return State{}, fmt.Errorf("open Profile configuration read-only without following links: %w", err)
 	}
 	var state State
 	if err := json.Unmarshal(data, &state); err != nil {