Prevent symlink-following chown in vcap-writable directories

[colins]

Overview

Problem

CreateJobPrerequisites() runs as root on the host before launching a bpm container. Previously:

1. Additional volume paths were checked via os.Stat and chowned via os.Chown, both of which follow symlinks.
2. Directory creation via createDirFor performed os.MkdirAll followed by os.Chown, which also followed symlinks.

Because these paths reside in or can be placed in directories writable by the vcap user (such as ephemeral data directories or log directories), a compromised container could plant a symlink to an arbitrary host file or directory (e.g. /etc or /etc/shadow). On the next bpm start or restart, root-bpm would dereference the symlink and chown the host target to vcap, enabling container escape and root escalation.

Fix

• Added safeio.MkdirAllChown and safeio.Lchown which use os.Lstat and os.Lchown (lchown(2)) to verify targets are not symlinks and prevent following symbolic links during ownership changes.
• Updated CreateJobPrerequisites to inspect additional volume paths with os.Lstat, rejecting symlink paths.
• Replaced createDirFor and chownPaths with safeio.MkdirAllChown and safeio.Lchown.
• Added comprehensive unit tests in src/bpm/safeio/safeio_test.go and src/bpm/runc/adapter/adapter_test.go.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}