The CVE-2026-17106 hardening rejects hardlink entries whose target is an
absolute path. Some image builders (e.g. kaniko) write hardlink targets
as absolute paths, so layers of such images fail to extract with
"invalid hardlink target" since v0.3.0 (Docker 29.7.0).

Resolve absolute hardlink targets relative to the extraction root with
chroot-like semantics, matching how absolute symlink targets are handled
since 4f6cd58 and how pre-v0.3.0 extraction behaved. The root is stripped
from the original linkname rather than the cleaned one, so targets like
"/../victim" are not collapsed against "/" but keep failing the
filepath.IsLocal check, and the resolved target then passes through
resolveArchivePath confined to the os.Root extraction root.

Signed-off-by: Yannik Sembritzki <yannik@sembritzki.org>

archive: resolve absolute hardlink targets within extraction root (fixes #99)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

archive: add test for chmod fallback on nodev mounts (skipped)

Add a regression test that runs the chmod fallback after switching into a
temporary root without procfs mounted.

This reproduces the environment used by chrootarchive, where resolving an
O_PATH descriptor through /proc/self/fd is unavailable.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

archive: test chmod fallback without procfs in chroot

skipping on Linux, which is currently broken.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

archive: test chmod fallback without read permission

Commit [f43ca4d][1] introduced an O_RDONLY-based chmod fallback for systems where
fchmodat with AT_SYMLINK_NOFOLLOW is unsupported. Opening a device node this
way fails with EACCES when the filesystem is mounted with nodev.

Use O_PATH to reference the entry without opening the underlying device, then
apply the mode through /proc/self/fd. Keep the existing fallback on non-Linux
Unix platforms.

[1]: f43ca4d

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Open /proc/self/fd before switching root and pass the descriptor to the
archive extraction internals. This allows the chmod fallback to resolve
pinned O_PATH descriptors when procfs is not mounted inside the chroot.

Keep the descriptor owned by chrootarchive and expose it through internal
archive options for the duration of the extraction.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Keep ProcSelfFD reachable until fchmodat completes. Without an explicit
liveness reference, the os.File may become eligible for finalization after
Fd returns, allowing its descriptor to be closed while the syscall is in
progress.

Co-authored-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

archive: fix chmod fallback for device nodes on nodev mounts

Open temporary descriptors with O_CLOEXEC to prevent inheritance by
concurrently started child processes.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

archive: set close-on-exec for chmod fallback descriptors