pub fn resolve_safe_bin(name: &str) -> Option<PathBuf>Expand description
Resolve name to an absolute path inside one of the trusted system
binary directories. Returns None if not found in any trusted dir
(do NOT fall back to Command::new(name) - that’s exactly the bug).
A candidate is accepted only when its lexical parent is a trusted dir AND its
real target (following symlinks) is a regular file owned by root or the
current effective uid, see [is_safe_target]. That ownership gate narrows
the symlink-swap vector AT CHECK TIME without breaking legitimate cross-dir
symlinks (e.g. Homebrew’s /opt/homebrew/bin/git -> ../Cellar/.../git, which
is owned by the installing user). The returned path is the trusted-dir path
(not the resolved target), so the allowlist contract is preserved.
RESIDUAL TOCTOU: the ownership check and the eventual Command exec are two
separate resolutions of the same path. In a group/user-writable trusted dir
an attacker who owns the dir can pass the check with a root-owned target and
then swap the symlink before exec. Closing this fully requires the spawn site
to exec the checked fd directly (fexecve / O_PATH|O_NOFOLLOW) or re-stat
immediately before spawn; this function guarantees check-time safety only.