fix(file): reject dangling-symlink writes outside workspace

[cursor]

Bug and impact

With workspace_only (on by default), write_file walked to the first existing ancestor when realpath failed. A dangling symlink in the workspace therefore passed the prefix check, and fopen("w") followed it and created or truncated a host file outside the workspace.

Camera capture used the same ancestor walk for caller-supplied JPEG paths.

Concrete trigger (main d367477)

1. Workspace /tmp/ws, sandbox/workspace_only on.
2. Create a dangling link: python3 -c 'import os; os.symlink("/tmp/sc_pwned","leak")' (allowlist skips this; same first step as fix(sandbox): Landlock + relative-token block for workspace FS escapes #74).
3. write_file path=/tmp/ws/leak content=pwned.
4. /tmp/sc_pwned is created on the host. read_file of an existing outside symlink is already denied via realpath.

Same walk applies to camera_capture path=.

Distinctness

• Not fix(file): do not collapse missing path components onto ancestor files #67 (missing nested path collapsed onto an ancestor file).
• Not fix(sandbox): Landlock + relative-token block for workspace FS escapes #74 (shell cat leak of a relative symlink; Landlock in fix(sandbox): Landlock FS bound plus workspace_only defense-in-depth #89 does not bound the file tool, which runs in the agent process).
• Not fix(file): persist workspace writes with atomic replace #78 (truncate-then-write ENOSPC).
• Not fix(sandbox): keep agent workspace off gateway state files #79 (workspace colocated with auth_tokens.json).
• Not fix(sandbox): Landlock FS bound plus workspace_only defense-in-depth #89 (sandbox allowlist + Landlock on sandbox_exec only).

Fix

• If the requested path is an unresolvable symlink, deny (do not fall back to the ancestor).
• write_file opens with O_NOFOLLOW when workspace_only is set so a TOCTOU swap cannot follow a link.
• Camera path_inside_workspace uses the same dangling-symlink deny.

Test plan

• CI=true make test_file — test_file_write_dangling_symlink_rejected
• CI=true make test_hardware_camera — test_output_dangling_symlink_rejected
• CI=true make test_shell

Does not re-open #66/#74/#76/#82 (still present on main; tracked by #89).

  

[adriannoes]

Superseded by #94 (já em development).