fix: use lstat() in CreateTarget to prevent symlink traversal outside sandbox_root

[Ashutosh0x]

Fixes #28515

Summary

CreateTarget() in linux-sandbox-pid1.cc uses stat() to check whether a path already exists before creating mount targets under sandbox_root. Since stat() follows symlinks, a pre-seeded symlink under sandbox_root causes subsequent mkdir()/link() calls to operate on the host filesystem outside sandbox_root.

This is a robustness/hardening issue: hermetic sandbox setup code runs before pivot_root/chroot and performs host filesystem operations. If sandbox_root/<component> is unexpectedly a symlink, mount target creation can write outside the intended sandbox directory.

Root Cause

// BEFORE (vulnerable): stat() follows symlinks
if (stat(path, &sb) == 0) {
    // sb reflects the TARGET of any symlink, not the symlink itself
    // mkdir/link will operate at the symlink target (outside sandbox_root)
}

Fix

Two changes to CreateTarget():

1. Replaced stat() with lstat() -- lstat() does not follow symlinks, so it reports the symlink itself rather than its target.

2. Added explicit symlink rejection -- if lstat() detects a symlink (S_ISLNK), CreateTarget() now returns -1 with errno = ELOOP, preventing any further operations on the path.

// AFTER (safe): lstat() does not follow symlinks
if (lstat(path, &sb) == 0) {
    if (S_ISLNK(sb.st_mode)) {
        // Reject symlinks: following them could escape the sandbox root.
        errno = ELOOP;
        return -1;
    }
    // ... normal directory/file handling
}

Reproduction (from #28515)

proof_root="$(mktemp -d)"
sandbox_root="$proof_root/sandbox"
outside_root="$proof_root/outside"
mkdir -p "$sandbox_root"
ln -s "$outside_root" "$sandbox_root/mnt"
# Run linux-sandbox with hermetic mode -- CreateTarget will follow the symlink
# Before fix: "$outside_root/<something>" gets created on the host
# After fix: CreateTarget returns ELOOP, mount setup fails safely

Related

• linux-sandbox: TEST_TMPDIR from action env is used as -w bind mount without validation; TMPDIR is sanitized, TEST_TMPDIR is not #29457 -- TEST_TMPDIR sandbox escape (fix in PR fix: validate TEST_TMPDIR in getWritableDirs to prevent sandbox escape via arbitrary bind mounts #29644)
• linux-sandbox: SandboxStash reads TEST_SRCDIR from action env without validation, enabling path traversal outside sandboxExecRoot with --reuse_sandbox_directories #29476 -- TEST_SRCDIR path traversal (fix in PR fix: validate TEST_SRCDIR in SandboxStash to prevent path traversal outside sandboxExecRoot #29631)

/cc @meisterT