Function chown_sandbox_home

crates/openshell-supervisor-process/src/process.rs:1105–1136

(root: &Path, uid: Option<Uid>, gid: Option<Gid>)

/// no untrusted process is running yet.
#[cfg(unix)]
fn chown_sandbox_home(root: &Path, uid: Option<Uid>, gid: Option<Gid>) -> Result<()> {
    use nix::unistd::chown;

    let meta = std::fs::symlink_metadata(root).into_diagnostic()?;
    if meta.file_type().is_symlink() {
        return Err(miette::miette!(
            "path '{}' is a symlink — refusing to chown (potential privilege escalation)",
            root.display()
        ));
    }

    chown(root, uid, gid).into_diagnostic()?;

    if meta.is_dir()
        && let Ok(entries) = std::fs::read_dir(root)
    {
        for entry in entries {
            let entry = entry.into_diagnostic()?;
            let path = entry.path();
            if path
                .symlink_metadata()
                .is_ok_and(|m| m.file_type().is_symlink())
            {
                debug!(path = %path.display(), "Skipping symlink during sandbox home chown");
                continue;
            }
            chown_sandbox_home(&path, uid, gid)?;
        }
    }

    Ok(())
}

/// Prepare filesystem for the sandboxed process.
///