imaginator: Fix symlink resolution for copy and append to stay within image rootfs

lib/fsutil/api.go

@@ -32,13 +32,25 @@ func AppendFile(destFilename, sourceFilename string) error {
 	return appendFile(destFilename, sourceFilename)
 }
 
+// AppendFileWithRoot extends AppendFile with safe symlink evaluation. Relative
+// symlinks are clamped to the root boundary, and absolute symlinks are rebased
+// against the root using chroot-style semantics.
+func AppendFileWithRoot(rootFd int, destRelPath, sourcePath string) error {
+	return appendFileWithRoot(rootFd, destRelPath, sourcePath)
+}
+
 // AppendTree recursively merges sourceDir into destDir.
-// It appends contents to existing files or copies new ones
-// while preserving permissions.
-// Directory structures are mirrored.
-// Returns an error if symlinks or non-regular files are encountered.
+// Existing regular files will have data appended. Files which do not exist in
+// destDir will be copied with the source file permissions.
+// Directory structures will be mirrored. An error is returned if symlinks or
+// non-regular files are encountered in sourceDir. If a destination path is a
+// symlink, it is resolved within destDir using chroot-style semantics:
+// absolute targets are anchored at destDir and ".." is clamped at its root.
+// Dangling symlinks cause an error.
+// Valid symlink targets within destDir will have data appended
+// to the resolved file; the symlink itself is preserved.
 func AppendTree(destDir, sourceDir string) error {
-	return appendTree(destDir, sourceDir, AppendFile)
+	return appendTree(destDir, sourceDir, AppendFileWithRoot)
 }
 
 // CompareFile will read and compare the content of a file and buffer and will

lib/fsutil/append.go

@@ -7,6 +7,8 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+
+	"golang.org/x/sys/unix"
 )
 
 func appendToFile(destFilename string, reader io.Reader,
@@ -40,6 +42,7 @@ func appendFile(destFilename, sourceFilename string) error {
 			}
 			return copyFile(destFilename, sourceFilename, mode, false)
 		}
+		return err
 	}
 	sourceFile, err := os.Open(sourceFilename)
 	if err != nil {
@@ -50,28 +53,54 @@ func appendFile(destFilename, sourceFilename string) error {
 	return appendToFile(destFilename, sourceFile, 0)
 }
 
+func appendFileWithRoot(rootFd int, destRelPath, sourcePath string) error {
+	mode, err := getFilePerms(sourcePath)
+	if err != nil {
+		return err
+	}
+	destFile, err := secureOpenFile(rootFd, destRelPath, uint32(mode))
+	if err != nil {
+		return err
+	}
+	defer destFile.Close()
+	sourceFile, err := os.Open(sourcePath)
+	if err != nil {
+		return errors.New(sourcePath + ": " + err.Error())
+	}
+	_, err = io.Copy(destFile, sourceFile)
+	if err != nil {
+		return fmt.Errorf(
+			"error copying contents from source %q to dest %q: %w",
+			sourcePath, destRelPath, err)
+	}
+	return nil
+}
+
 func appendTree(destDir, sourceDir string,
-	appendFunc func(dest, src string) error) error {
+	appendFunc func(rootFd int, destRelPath, sourcePath string) error) error {
+	rootFd, err := openRoot(destDir)
+	if err != nil {
+		return err
+	}
+	defer unix.Close(rootFd)
 	return filepath.WalkDir(sourceDir,
 		func(path string, d fs.DirEntry, err error) error {
 			if err != nil {
 				return err
 			}
+			if path == sourceDir {
+				return nil
+			}
 			relPath, err := filepath.Rel(sourceDir, path)
 			if err != nil {
 				return err
 			}
-			destFilename := filepath.Join(destDir, relPath)
 			fileType := d.Type()
 			switch {
 			case fileType.IsDir():
-				// If path is a directory, create directory and return.
-				// WalkDir will automatically visit the children next.
-				if err := os.MkdirAll(destFilename, DirPerms); err != nil {
-					return err
-				}
+				return secureMkdir(rootFd, relPath, DirPerms)
 			case fileType.IsRegular():
-				if err := appendFunc(destFilename, path); err != nil {
+				if err := appendFunc(rootFd, relPath, path); err != nil {
 					return err
 				}
 			case fileType&fs.ModeSymlink != 0: