Sync symlink/ownership hardening from upstream

[artursarlo]

Summary

This PR continues our upstream CVE/security sync. Our previous sync (#80) backported dependency fixes up to intel/gprofiler#1046, but two code-level security fixes had already landed upstream (intel/gprofiler) before then and were intentionally out of scope for that dependency-focused PR. A fresh scan of upstream master confirms these are still the only security fixes missing from our fork. Each change below mirrors upstream, reconciled against our fork's divergence.

Changes & rationale

1. Restore ownership validation + add symlink checks in mkdir_owned_root

Backports intel/gprofiler#1047.

• Adds is_owned_by_current_user() and, in mkdir_owned_root_wrapper() (non-root path), validates the directory is owned by the current user instead of merely writable.
• Adds symlink checks (reject, don't follow) to both mkdir_owned_root() and mkdir_owned_root_wrapper(), before and after creation, to prevent symlink attacks.
• Upstream's PR primarily removed an erroneous unconditional return that made the ownership check dead code (introduced in 5285bef7). Our fork had already fixed that dead-code bug via an assert is_root() rewrite of mkdir_owned_root(), so this change layers in only the missing symlink/ownership hardening while preserving our fork's assert is_root() design and shutil.rmtree-and-recreate behavior.

2. Fix symlink escape vulnerabilities in safe_copy and log reading (CWE-59)

Backports intel/gprofiler#1050.

• safe_copy(): uses O_EXCL for atomic temp-file creation (defeats symlink redirection of writes), adds a defense-in-depth dst symlink check before rename, and fixes an fd leak if os.fdopen() fails.
• Adds safe_read_text(): reads files with O_NOFOLLOW so the kernel atomically rejects symlinks at open time; fixes an fd leak on os.fdopen() failure. Adds _O_NOFOLLOW with a getattr fallback for portability.
• gprofiler/profilers/java.py: _read_ap_log() now uses safe_read_text() for the async-profiler log path.

These close two container-escape vectors:

1. Write escape — attacker plants a symlink at the libasyncProfiler.so copy destination to overwrite arbitrary host files.
2. Read escape — attacker plants a symlink at the async-profiler log path to exfiltrate host file contents into gProfiler logs.

Notes

• A straight cherry-pick was not viable: our gprofiler/utils/fs.py has diverged from upstream (the assert is_root() rewrite of mkdir_owned_root and rmtree behavior). The security hardening was reconciled by hand; a git diff --no-index against upstream master post-Fix symlink escape vulnerabilities in safe_copy and log file reading (CWE-59) intel/gprofiler#1050 shows the result is identical except for those intentional fork differences.
• Dependency/version-bump changes already covered by Sync missing CVE/security fixes from upstream #80 (up to Bump version to 1.57.1 and update Alpine to 3.24.1 intel/gprofiler#1046) require no action here. No new Go/backend or Python security fixes have landed upstream since.

Test plan

• python -m py_compile gprofiler/utils/fs.py gprofiler/profilers/java.py passes.
• Reconciled fs.py verified against upstream/master (post-Fix symlink escape vulnerabilities in safe_copy and log file reading (CWE-59) intel/gprofiler#1050) via git diff --no-index; only the intentional assert is_root() fork customizations differ.