pub fn open_beneath(
root: &Path,
rel: &Path,
intent: OpenIntent,
) -> Result<File, Error>Expand description
Open root-relative rel for intent without ever traversing out of
root — closing the check-then-write TOCTOU where an intermediate
directory is swapped for a symlink after a lexical path check but before the
operation (#77). The returned File is bound to the exact inode the
confinement resolved, so subsequent reads/writes can’t be redirected.
On Linux this is enforced atomically by the kernel via
openat2(RESOLVE_BENEATH) relative to a directory fd for root. We use
RESOLVE_BENEATH (which forbids escaping the root via absolute paths, ..,
or magic links) but not RESOLVE_NO_SYMLINKS, so legitimate in-tree
symlinks keep working — only escapes are refused, matching the existing
[contain_within_canonical] semantics. On pre-5.6 kernels (ENOSYS) or
non-Linux targets it falls back to contain_within_canonical + a plain open
(documented best-effort: the lexical check still holds, but the open is by
path).