fix(sandbox): resolve multi-hop symlinks in fs grants

Signed-off-by: James Carnegie <me@kipz.org>

Author: kipz

crates/nono-cli/tests/symlink_hop_run.rs

@@ -0,0 +1,79 @@
+//! Kernel-level coverage for nolabs-ai/nono#1771: a capability
+//! granted over a multi-hop symlink chain (a symlinked leaf pointing through
+//! a symlinked directory component, the common `stow`/`chezmoi` dotfiles
+//! shape) must resolve end-to-end under the real Seatbelt sandbox, without
+//! widening access to unrelated files reachable through the same
+//! intermediate directory.
+
+#![cfg(target_os = "macos")]
+
+use nono_test_support::{Argv, nono_test};
+use std::fs;
+
+/// Builds the multi-hop symlink fixture under `t.workspace()`:
+///
+/// ```text
+/// .gitconfig -> hosts/current/gitconfig -> hosts/mymac/gitconfig
+/// hosts/current -> hosts/mymac   (symlinked directory component)
+/// ```
+///
+/// `hosts/mymac/secret.txt` sits beside the real target but is not part of
+/// the granted capability's own resolution chain.
+fn write_fixture(workspace: &std::path::Path) -> (std::path::PathBuf, std::path::PathBuf) {
+    let hosts = workspace.join("hosts");
+    let mymac = hosts.join("mymac");
+    fs::create_dir_all(&mymac).expect("create hosts/mymac");
+    fs::write(mymac.join("gitconfig"), "trusted\n").expect("write real gitconfig");
+    fs::write(mymac.join("secret.txt"), "topsecret\n").expect("write sibling secret");
+
+    let current = hosts.join("current");
+    std::os::unix::fs::symlink(&mymac, &current).expect("symlink hosts/current -> hosts/mymac");
+
+    let gitconfig_link = workspace.join(".gitconfig");
+    std::os::unix::fs::symlink(current.join("gitconfig"), &gitconfig_link)
+        .expect("symlink .gitconfig -> hosts/current/gitconfig");
+
+    (gitconfig_link, mymac.join("secret.txt"))
+}
+
+#[test]
+fn multi_hop_symlinked_leaf_resolves_through_symlinked_directory() {
+    let t = nono_test!("symlink-hop-positive");
+    let workspace = t.workspace().to_path_buf();
+    let (gitconfig_link, _secret) = write_fixture(&workspace);
+
+    let profile = t.write_profile(
+        "symlink-hop-positive",
+        &format!(
+            r#"{{"meta":{{"name":"t"}},"workdir":{{"access":"readwrite"}},"filesystem":{{"read":["{}"]}}}}"#,
+            gitconfig_link.display()
+        ),
+    );
+
+    t.run()
+        .profile(&profile)
+        .exec(Argv::new("/bin/cat").arg(&gitconfig_link))
+        .assert_stdout_contains("trusted");
+}
+
+#[test]
+fn multi_hop_symlinked_leaf_does_not_widen_access_to_sibling_in_traversed_directory() {
+    let t = nono_test!("symlink-hop-negative");
+    let workspace = t.workspace().to_path_buf();
+    let (gitconfig_link, secret) = write_fixture(&workspace);
+
+    let profile = t.write_profile(
+        "symlink-hop-negative",
+        &format!(
+            r#"{{"meta":{{"name":"t"}},"workdir":{{"access":"readwrite"}},"filesystem":{{"read":["{}"]}}}}"#,
+            gitconfig_link.display()
+        ),
+    );
+
+    t.run()
+        .profile(&profile)
+        .exec(Argv::new("/bin/cat").arg(&secret))
+        .assert_failure(
+            "granting a multi-hop symlink must not expose sibling files under the traversed directory",
+        );
+}

crates/nono-cli/tests/symlink_hop_run_linux.rs

@@ -0,0 +1,85 @@
+//! Linux Landlock parity coverage for nolabs-ai/nono#1771: the
+//! same multi-hop symlink chain fixed for macOS Seatbelt in
+//! `symlink_hop_run.rs` must resolve end-to-end under real Landlock
+//! enforcement too, without widening access to unrelated files reachable
+//! through the same intermediate directory.
+//!
+//! Linux needs no code change for this bug: `open_path_rule` opens
+//! `cap.resolved` directly with `O_PATH`, so the kernel resolves the whole
+//! symlink chain before Landlock ever sees a literal intermediate path. This
+//! test exists to prove that resolution-safety empirically under real
+//! enforcement, rather than leave it as an unverified claim about Linux's
+//! `O_PATH` model.
+
+#![cfg(target_os = "linux")]
+
+use nono_test_support::{Argv, nono_test};
+use std::fs;
+
+/// Builds the multi-hop symlink fixture under `t.workspace()`:
+///
+/// ```text
+/// .gitconfig -> hosts/current/gitconfig -> hosts/mymac/gitconfig
+/// hosts/current -> hosts/mymac   (symlinked directory component)
+/// ```
+///
+/// `hosts/mymac/secret.txt` sits beside the real target but is not part of
+/// the granted capability's own resolution chain.
+fn write_fixture(workspace: &std::path::Path) -> (std::path::PathBuf, std::path::PathBuf) {
+    let hosts = workspace.join("hosts");
+    let mymac = hosts.join("mymac");
+    fs::create_dir_all(&mymac).expect("create hosts/mymac");
+    fs::write(mymac.join("gitconfig"), "trusted\n").expect("write real gitconfig");
+    fs::write(mymac.join("secret.txt"), "topsecret\n").expect("write sibling secret");
+
+    let current = hosts.join("current");
+    std::os::unix::fs::symlink(&mymac, &current).expect("symlink hosts/current -> hosts/mymac");
+
+    let gitconfig_link = workspace.join(".gitconfig");
+    std::os::unix::fs::symlink(current.join("gitconfig"), &gitconfig_link)
+        .expect("symlink .gitconfig -> hosts/current/gitconfig");
+
+    (gitconfig_link, mymac.join("secret.txt"))
+}
+
+#[test]
+fn multi_hop_symlinked_leaf_resolves_through_symlinked_directory() {
+    let t = nono_test!("symlink-hop-positive-linux");
+    let workspace = t.workspace().to_path_buf();
+    let (gitconfig_link, _secret) = write_fixture(&workspace);
+
+    let profile = t.write_profile(
+        "symlink-hop-positive-linux",
+        &format!(
+            r#"{{"meta":{{"name":"t"}},"workdir":{{"access":"readwrite"}},"filesystem":{{"read":["{}"]}}}}"#,
+            gitconfig_link.display()
+        ),
+    );
+
+    t.run()
+        .profile(&profile)
+        .exec(Argv::new("/bin/cat").arg(&gitconfig_link))
+        .assert_stdout_contains("trusted");
+}
+
+#[test]
+fn multi_hop_symlinked_leaf_does_not_widen_access_to_sibling_in_traversed_directory() {
+    let t = nono_test!("symlink-hop-negative-linux");
+    let workspace = t.workspace().to_path_buf();
+    let (gitconfig_link, secret) = write_fixture(&workspace);
+
+    let profile = t.write_profile(
+        "symlink-hop-negative-linux",
+        &format!(
+            r#"{{"meta":{{"name":"t"}},"workdir":{{"access":"readwrite"}},"filesystem":{{"read":["{}"]}}}}"#,
+            gitconfig_link.display()
+        ),
+    );
+
+    t.run()
+        .profile(&profile)
+        .exec(Argv::new("/bin/cat").arg(&secret))
+        .assert_failure(
+            "granting a multi-hop symlink must not expose sibling files under the traversed directory",
+        );
+}

crates/nono/src/path.rs

@@ -1,6 +1,7 @@
 //! Path utilities shared across nono library and CLI.
 
-use std::path::{Path, PathBuf};
+use std::collections::HashSet;
+use std::path::{Component, Path, PathBuf};
 
 /// Canonicalize a path using an ancestor-walk fallback.
 ///
@@ -49,6 +50,106 @@ pub(crate) fn try_canonicalize_ancestor_walk(path: &Path) -> PathBuf {
     path.to_path_buf()
 }
 
+/// Maximum number of symlink dereferences [`collect_symlink_hops`] will
+/// follow, matching typical OS `ELOOP`/`MAXSYMLINKS` limits. Bounds the walk
+/// so a symlink cycle truncates instead of looping forever.
+const MAX_SYMLINK_HOPS: usize = 40;
+
+/// Enumerate every intermediate absolute path produced while resolving a
+/// multi-hop symlink chain, e.g. a symlinked leaf pointing through a
+/// symlinked directory component.
+///
+/// Unlike [`try_canonicalize`], which resolves an entire chain in one
+/// `std::fs::canonicalize()` call and only ever sees the two endpoints, this
+/// walks the path component by component and records the literal path of
+/// every symlink it dereferences along the way (including symlinked
+/// directory components, not just a symlinked leaf). Callers use this to
+/// find hops that are neither the original path, the final resolved path,
+/// nor an ancestor of either -- and so would otherwise get no sandbox grant
+/// at all, causing `EPERM` when the kernel dereferences that literal
+/// component.
+///
+/// Returns an empty vec when `path` contains no symlinks. Silently stops
+/// (returning whatever was collected so far) on a cycle or a chain deeper
+/// than [`MAX_SYMLINK_HOPS`], rather than erroring -- a cycle or excessively
+/// deep chain will fail its own `open()` at run time regardless.
+///
+/// Callers that already hold a canonicalized `resolved` path (e.g.
+/// `FsCapability`) call this separately, against the live filesystem, at
+/// profile-generation time. If the on-disk symlink chain changes between
+/// that earlier canonicalization and this walk, the hop set and `resolved`
+/// can briefly disagree -- the same TOCTOU window `original`/`resolved`
+/// already have, just with a few more syscalls in it.
+pub fn collect_symlink_hops(path: &Path) -> Vec<PathBuf> {
+    let mut hops = Vec::new();
+    let mut seen = HashSet::new();
+    let mut depth = 0usize;
+    resolve_hops(path, &mut hops, &mut seen, &mut depth);
+    hops
+}
+
+/// Resolve `path` component by component, recording the literal path of each
+/// symlink dereferenced into `hops`, and returning the fully resolved
+/// (as far as `depth` allows) absolute path.
+///
+/// `path` need not be absolute on entry (a symlink target can be relative);
+/// relative components are resolved against `result` as they're pushed.
+fn resolve_hops(
+    path: &Path,
+    hops: &mut Vec<PathBuf>,
+    seen: &mut HashSet<PathBuf>,
+    depth: &mut usize,
+) -> PathBuf {
+    let mut result = PathBuf::new();
+
+    for component in path.components() {
+        match component {
+            Component::Prefix(_) | Component::RootDir => {
+                result.push(component.as_os_str());
+            }
+            Component::CurDir => {}
+            Component::ParentDir => {
+                result.pop();
+            }
+            Component::Normal(segment) => {
+                result.push(segment);
+
+                if *depth >= MAX_SYMLINK_HOPS {
+                    continue;
+                }
+
+                let Ok(metadata) = std::fs::symlink_metadata(&result) else {
+                    continue;
+                };
+                if !metadata.file_type().is_symlink() {
+                    continue;
+                }
+
+                *depth += 1;
+                if seen.insert(result.clone()) {
+                    hops.push(result.clone());
+                }
+
+                let Ok(target) = std::fs::read_link(&result) else {
+                    continue;
+                };
+                let target = if target.is_absolute() {
+                    target
+                } else {
+                    result
+                        .parent()
+                        .map(|parent| parent.join(&target))
+                        .unwrap_or(target)
+                };
+
+                result = resolve_hops(&target, hops, seen, depth);
+            }
+        }
+    }
+
+    result
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -93,4 +194,103 @@ mod tests {
             assert_eq!(result, real_file.canonicalize().expect("canonicalize"));
         }
     }
+
+    #[cfg(unix)]
+    #[test]
+    fn collect_symlink_hops_empty_for_plain_path() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let canonical_dir = dir.path().canonicalize().expect("canonicalize");
+        let real_file = canonical_dir.join("real.txt");
+        fs::write(&real_file, "hello").expect("write file");
+        assert!(collect_symlink_hops(&real_file).is_empty());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn collect_symlink_hops_single_hop_leaf_symlink() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let canonical_dir = dir.path().canonicalize().expect("canonicalize");
+        let real_file = canonical_dir.join("real.txt");
+        fs::write(&real_file, "hello").expect("write file");
+        let link = canonical_dir.join("link.txt");
+        std::os::unix::fs::symlink(&real_file, &link).expect("symlink");
+
+        let hops = collect_symlink_hops(&link);
+        assert_eq!(hops, vec![link]);
+    }
+
+    /// A symlinked leaf pointing through a symlinked directory component,
+    /// e.g.
+    /// `~/.gitconfig -> hosts/current/gitconfig -> hosts/mymac/gitconfig`
+    /// where `hosts/current -> hosts/mymac` is itself a symlinked directory.
+    #[cfg(unix)]
+    #[test]
+    fn collect_symlink_hops_multi_hop_through_symlinked_directory() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let canonical_dir = dir.path().canonicalize().expect("canonicalize");
+
+        let hosts = canonical_dir.join("hosts");
+        let mymac = hosts.join("mymac");
+        fs::create_dir_all(&mymac).expect("mkdir mymac");
+        let real_gitconfig = mymac.join("gitconfig");
+        fs::write(&real_gitconfig, "[user]\n").expect("write gitconfig");
+
+        let current = hosts.join("current");
+        std::os::unix::fs::symlink(&mymac, &current).expect("symlink dir");
+
+        let gitconfig_link = canonical_dir.join(".gitconfig");
+        std::os::unix::fs::symlink(current.join("gitconfig"), &gitconfig_link)
+            .expect("symlink leaf");
+
+        let hops = collect_symlink_hops(&gitconfig_link);
+        assert_eq!(hops, vec![gitconfig_link.clone(), current]);
+
+        // The fully resolved target is unaffected -- std canonicalization
+        // still collapses the whole chain in one shot.
+        assert_eq!(
+            try_canonicalize(&gitconfig_link),
+            real_gitconfig.canonicalize().expect("canonicalize")
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn collect_symlink_hops_cycle_truncates_instead_of_looping() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let canonical_dir = dir.path().canonicalize().expect("canonicalize");
+        let a = canonical_dir.join("a");
+        let b = canonical_dir.join("b");
+        std::os::unix::fs::symlink(&b, &a).expect("symlink a->b");
+        std::os::unix::fs::symlink(&a, &b).expect("symlink b->a");
+
+        let hops = collect_symlink_hops(&a);
+        // Must terminate (this test itself is the proof); depth-bounded, so
+        // only ever sees the two distinct literal hop paths.
+        assert!(hops.len() <= MAX_SYMLINK_HOPS);
+        assert!(hops.contains(&a));
+        assert!(hops.contains(&b));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn collect_symlink_hops_nonexistent_final_target_keeps_existing_hops() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let canonical_dir = dir.path().canonicalize().expect("canonicalize");
+
+        let hosts = canonical_dir.join("hosts");
+        let mymac = hosts.join("mymac");
+        fs::create_dir_all(&mymac).expect("mkdir mymac");
+        // Note: no `gitconfig` file written under mymac -- final target
+        // does not exist, but the directory symlink hop is still real.
+
+        let current = hosts.join("current");
+        std::os::unix::fs::symlink(&mymac, &current).expect("symlink dir");
+
+        let gitconfig_link = canonical_dir.join(".gitconfig");
+        std::os::unix::fs::symlink(current.join("gitconfig"), &gitconfig_link)
+            .expect("symlink leaf");
+
+        let hops = collect_symlink_hops(&gitconfig_link);
+        assert_eq!(hops, vec![gitconfig_link, current]);
+    }
 }