v0.328.0 (unreleased): the security review's four findings — the entry is bound to its image and start; symlinks out of a root; the missed classes; roots only under the drive namespace or system data

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/allowlist.go

@@ -53,7 +53,8 @@ func (m *Manager) admitCompose(name string, data []byte, env map[string]string)
 	if env != nil {
 		e = m.policyEnv(env)
 	}
-	err := privpolicy.Admit(name, data, e, privpolicy.Policy{SystemDataPath: m.sysDataPath})
+	// Resolve: a bind source that is a symlink out of its data root is outside (it is judged where it points).
+	err := privpolicy.Admit(name, data, e, privpolicy.Policy{SystemDataPath: m.sysDataPath, Resolve: filepath.EvalSymlinks})
 	m.noteAdmission(name, data, err)
 	return err
 }