[Seatbelt] Fix symlink and parent-traversal policy enforcement

[Elliot (theelliotm)]

📖 Description

• Resolve Seatbelt policy symlinks before applying .., preserving deny/read-only precedence across aliases.
• Reject broken or inaccessible policy paths before launch; support not-yet-created trailing paths.
• Separate macOS host preparation from platform-independent profile generation.
• Add 22 executor regression cases to scheduled macOS validation and replace the blanket .. rejection test.
• Report shared-resolver errors. Bubblewrap retains its existing deny-mask fallback; DNS-target resolution rejects errors.

🔗 References

No linked issue. Updates docs/backends/seatbelt/seatbelt-backend.md.

🔍 Validation

Command	Result
cargo test --locked --quiet -p mxc-sdk --lib -- seatbelt	Passed: 137 tests
cargo fmt --all -- --check	Passed
cargo clippy --locked --quiet -p mxc-sdk --lib --tests -- -D warnings	Passed
cargo clippy --locked --quiet -p mxc-sdk --lib --tests --target x86_64-unknown-linux-gnu -- -D warnings	Passed: Linux cross-target compile/lint
cargo build --locked --quiet -p mxc_darwin	Passed
MXC_EXEC_MAC="$PWD/src/target/debug/mxc-exec-mac" bash tests/scripts/run_seatbelt_symlink_test.sh	Passed: 22 scenarios
MXC_EXEC_MAC="$PWD/src/target/debug/mxc-exec-mac" bash tests/scripts/run_seatbelt_options_test.sh	Passed: 19 assertions, including Keychain access and profile overrides

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

---

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The existing Linux symlink-loop test expects the previous diagnostic and will fail the proxy-network CI step.

1 open issue

• Update symlink loop test for new resolution error · New

What changed in this PR

Corrects Seatbelt filesystem policy enforcement so symlink aliases and parent traversal preserve access restrictions.

Changes:

• Resolves policy paths before profile generation and rejects resolution errors.
• Separates macOS host preparation from platform-independent profile rendering.
• Adds 22 executor regression scenarios and updates backend documentation.

File	Description
tests/​scripts/​run_seatbelt_symlink_test.sh	Adds symlink enforcement regressions.
tests/​scripts/​run_seatbelt_path_resolution_test.sh	Tests supported parent traversal.
tests/​scripts/​run_seatbelt_all_tests.sh	Includes the symlink suite.
tests/​configs/​seatbelt_path_dotdot.json	Exercises a parent-traversal grant.
src/​mxc-sdk/​src/​core/​mxc_common/​mod.rs	Enables shared resolution on macOS.
src/​mxc-sdk/​src/​core/​mxc_common/​filesystem_symlink.rs	Records path resolution failures.
src/​mxc-sdk/​src/​backends/​seatbelt/​common/​seatbelt_runner.rs	Prepares inputs before rendering.
src/​mxc-sdk/​src/​backends/​seatbelt/​common/​profile_preparation.rs	Resolves paths and discovers host directories.
src/​mxc-sdk/​src/​backends/​seatbelt/​common/​profile_builder.rs	Renders prepared profile inputs.
src/​mxc-sdk/​src/​backends/​seatbelt/​common/​mod.rs	Registers macOS preparation.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​proxy_network.rs	Rejects DNS-target resolution errors.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​bwrap_runner.rs	Logs failures while preserving mask fallback.
docs/​backends/​seatbelt/​seatbelt-backend.md	Documents resolution and rejection behavior.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Host-specific containment behavior and the remaining path-validation concern require final human review.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Validate symlink targets before canonicalizing readwrite paths

src/​mxc-sdk/​src/​core/​mxc_common/​filesystem_symlink.rs:54

[P2] symlink_metadata checks the link itself, not whether its target can be traversed. For a link whose stored target is file/../secret, with file a regular file and secret an existing sibling, macOS canonicalization can fold .. without rejecting the invalid traversal. A readwritePaths entry for that link can therefore grant access to secret instead of failing before launch. Check the followed target with metadata before accepting canonicalization, and extend the macOS executor regression cases to reject parent traversal inside a symlink target.

1 resolved since last review

• Update symlink loop test for new resolution error

_{Review effort: Balanced}