Summary

Write seccomp-unotify reports through a mode-0600 temporary file in the destination directory, then atomically replace the configured report path.

Why

Seccomp-unotify reports can contain traced execve arguments and environment entries. The current direct O_CREAT | O_TRUNC write creates a new report as mode 0644 under a typical umask and follows a pre-existing symlink. With a predictable report path in a shared directory, another local user can therefore read report contents or redirect a privileged report write into another file.

Creating the report privately and replacing the destination atomically keeps new contents owner-only and replaces a destination symlink rather than following it.

Validation

• Full Docker build with the project warnings-as-errors flags
• Privileged local integration: generated report contains traced data and is mode 0600
• Baseline comparison: current master creates the report as mode 0644
• Symlink regression: current master overwrites the symlink target; patched build leaves the target unchanged and replaces the destination with a private regular report
• Existing permissive report is replaced with a mode-0600 file
• Standalone nsjail smoke test