[Security] Reject symlink and special-file Agent Artifact Admission inputs #254

Finding

Agent Artifact Admission exact c4030f7fecaa5627ccec31ce58eca7e59db45334 opens both the reviewed policy configuration and protected credential document with File::open(path) and only then validates permissions on the resulting descriptor. The same-descriptor metadata check correctly closes the earlier pathname-metadata TOCTOU interval, but File::open still follows a final symbolic link and can block while opening a FIFO before Wardnet gets a chance to validate file type.

This is Wardnet-owned local admission-policy / credential bootstrap authority. It does not move effective runtime environment/config ownership out of quarantine-sandbox-runtime and does not duplicate EgressWeave, contextual-orchestrator or AppGuardrail behavior.

The existing audit sink already establishes the intended Linux pattern: O_NOFOLLOW | O_NONBLOCK, followed by regular-file validation on the same opened descriptor. Configuration and credential readers have not yet adopted that pattern.

Hostile RED acceptance

Against production source byte-identical to exact #129 head:

• a mode-0600 credential target reached only through a final symlink must fail closed rather than return the bearer token;
• a safe-permission reviewed policy target reached only through a final symlink must fail closed rather than load policy authority;
• a no-writer FIFO must not be allowed to block startup before file-type validation; the reader must open nonblocking and reject non-regular files;
• ordinary owner-only credential files and integrity-protected regular policy files remain accepted.

A symlink-only test is sufficient to establish the first semantic RED without creating an unbounded test; FIFO behavior should be added to the GREEN acceptance once the nonblocking open boundary exists.

Minimum causal repair

Use one Linux read-only open with O_NOFOLLOW | O_NONBLOCK, then validate regular-file type and the existing permission invariant on that same descriptor before materializing bounded bytes. Keep the current explicit fail-closed behavior on platforms where an equivalent native contract is not implemented. Do not add pathname pre-checks followed by a second open, because that would recreate a TOCTOU interval.

Traceability

• Linux/POSIX open: O_NOFOLLOW rejects a final symbolic link; O_NONBLOCK prevents FIFO read-open from waiting for a writer.
• MITRE CWE-59 / CWE-61: link following can resolve a security-sensitive pathname outside the intended control sphere.

Close only after the hostile regression, causal repair, exact-head CI/fuzz/security evidence and complete transfer into #129 or a verified successor are present. No force update, destructive rebase, gate weakening, self/model approval or predecessor-evidence reuse.