Module safe_fs 

Symlink-safe file primitives.

The daemon runs as root and writes state into /data/local/tmp (attacker-writable). Plain fs::write/OpenOptions follow symlinks, so an attacker who pre-creates a symlink at the target path — or swaps an intermediate directory for a symlink — causes a root write-through to an arbitrary file (N5).

Every primitive here is fd-anchored: the parent directory is resolved with O_NOFOLLOW at every path component and held as an open directory fd, then all operations (openat/renameat/unlinkat) run relative to that fd. A swapped parent directory or symlink therefore cannot redirect the write.

Functions

ensure_state_dir

Create dir if needed, then verify it is a real directory with no symlink component and that it is owned by the current effective uid. Returning the anchored fd lets callers refuse to operate inside an attacker-pre-created or attacker-redirected state directory.

open_append_nofollow

Open an existing-or-create append stream that refuses to follow symlinks.

read_nofollow

Read a file to a string, refusing to follow a symlink at the final or any parent component.

remove_nofollow

Remove a directory entry without following a final symlink, anchored to its (symlink-free) parent. The entry itself is removed even if it is a symlink; its target is never touched.

write_atomic

Atomically replace path with content.