Motivation

• The supervisor previously created and chowned every path in policy.filesystem.read_write while running as root, which follows symlinks and can change ownership of arbitrary targets.
• That behavior enables a malicious image to pre-create a symlink and escalate privileges by making sensitive root-owned paths writable by the sandbox user.
• The intent is to harden filesystem preparation so only legitimate directories declared by policy are prepared for the sandbox process.

Description

• In crates/openshell-sandbox/src/lib.rs prepare_filesystem now uses std::fs::symlink_metadata to inspect read_write entries before calling chown and retains std::fs::create_dir_all behavior for missing paths.
• The function returns an error if a read_write path is a symlink to prevent following and modifying arbitrary targets.
• The function returns an error if a read_write path exists but is not a directory to avoid unexpected ownership changes on files.
• Added unit tests that assert the function rejects a symlinked read_write path and rejects a non-directory read_write path, and kept behavior unchanged for valid directories.

Testing

• Ran targeted unit tests with cargo test -p openshell-sandbox prepare_filesystem_rejects_ --lib, and both new tests passed.
• cargo test -p openshell-sandbox prepare_filesystem_rejects_symlink_read_write_path --lib and cargo test -p openshell-sandbox prepare_filesystem_rejects_non_directory_read_write_path --lib succeeded.
• mise run pre-commit and mise run test were attempted but failed in this environment due to external tool resolution/network issues (tooling warnings from mise), not due to the code changes.

Codex Task