The direct answer
Use an explicit openat2 resolution profile and keep its returned descriptor through inspection and bounded reading; do not reopen a previously checked pathname. This only supports a narrow trusted-store design: path confinement does not establish current object rights, immutable contents or harmless opening effects.
Begin with a store you can actually trust
Suppose a fictional assistant summarizes Note-14 from workspace Cedar. The trusted service maps that opaque object ID to one approved relative name under an already held directory descriptor. The model chooses neither a host path nor a descriptor number. The manifest binds workspace, object revision, expected file identity and a bounded read lease.
The proposed store contains admitted ordinary files on a reviewed local filesystem. A trusted publisher freezes the snapshot before issuing the lease. During that lease, other actors cannot replace entries, introduce hard links or special files, change mounts, or modify contents through another alias. The application must establish these conditions independently; listing a directory beforehand is insufficient.
If the worker faces an attacker-writable tree, an untrusted filesystem implementation or uncontrolled namespace changes, this profile is inapplicable. Stop the request and choose a separately reviewed ingestion boundary. Do not advertise post-open inspection as an alternative to those assumptions.
Freeze one resolution and open contract
The sources here are Linux man-pages 6.19. The openat2 manual dates the interface to Linux 5.6 and documents no glibc wrapper; this establishes neither deployment availability nor a tested Linux 6.12 build.
Proposed configuration: zero-initialized open_how, size sizeof(struct open_how), mode zero, flags O_RDONLY | O_CLOEXEC | O_NOFOLLOW; resolve flags RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS | RESOLVE_NO_MAGICLINKS | RESOLVE_NO_XDEV. No create, truncate, writable access, O_PATH, cached-only mode or optional flags.
BENEATH rejects resolution outside the anchor; IN_ROOT instead reinterprets absolute paths and is not selected. Whole-path symlink rejection differs from final-component O_NOFOLLOW. Magic-link denial is explicit, although no-symlinks implies it. No-cross-mount also rejects bind mounts. That strictness is intentional for this dedicated store, not a general compatibility recommendation.
Unsupported or invalid configuration and every open error stop this request. An EAGAIN escape uncertainty is not success. Do not retry, relax flags, normalize then open, or switch APIs. The newer OPENAT2_REGULAR option is documented since Linux 7.2 and is excluded here.
Separate opening, identity and permission to release
The open manual describes a descriptor reference that survives pathname removal or retargeting. It also explains that O_PATH cannot supply ordinary reads, and that opening devices or FIFOs has distinct behavior. O_RDONLY is an access mode, not a universal no-effect or deadline guarantee.
Consequently, a later rejection cannot undo effects of opening an unexpected object. The positive store assumptions must hold before the open. Do not claim O_NONBLOCK would solve this; the manual says it does not prevent regular-file I/O waiting.
After success, inspect the same retained descriptor with fstat, require the regular-file type, and compare the manifest identity. The stat manual warns that different fields can reflect different moments; metadata is not an atomic content snapshot.
The proposed service then rechecks its current lease and stages only a bounded read from that descriptor. It never returns a path for another component to reopen. A changed manifest, failed check or read error discards staged bytes. The lease defines the authorized operation interval; immediate revocation during an in-flight read needs separate coordination. Descriptor possession alone grants no application permission. Retaining identity also does not freeze bytes: the immutable-store condition remains necessary.
Eight proposed admission cards
These invented cards are PROPOSED_UNRUN. Note-14 is an ordinary small note, not a crafted file. Each card records the store lease, request class, chosen profile, symbolic outcome and release decision. No files, descriptors, links, mounts or syscall results were created or observed.
| Card | Invented condition | Required application decision |
|---|---|---|
| 1. Ordinary note | Cedar lease active; frozen regular object; constrained open, identity and read checks all labeled successful. | Stage the bounded note; release only under the same current lease. This is the intended allowed workflow. |
| 2. Wrong anchor | The object ID belongs to another workspace, despite an otherwise plausible relative name. | Deny before opening. Kernel path restrictions cannot repair an application authorization mismatch. |
| 3. Escaping request | The reference class is absolute or attempts to leave the anchor. | Reject; no rewriting into a convenient local name and no alternate root interpretation. |
| 4. Link-dependent lookup | Resolution would need an intermediate/final symbolic link or magic link. | Deny under the fixed profile. Do not return a link handle or retry with reduced restrictions. |
| 5. Mount-dependent lookup | The desired object requires a bind mount or another mount crossing. | Deny; route the legitimate workload for a separate design review rather than silently widen this store. |
| 6. Unsupported or uncertain open | The symbolic result indicates unavailable configuration, a failure or escape uncertainty. | Stop this request with an operational reason. No success inference from a previous string check or an attempted open. |
| 7. Store promise violated | A publisher or another actor can substitute a device, FIFO, hard-linked object or mutable revision. | Do not perform the proposed read-open. If discovered afterward, contain/discard and investigate; late inspection was not preventive. |
| 8. Handle accepted, release denied | Type/identity checks fail, the lease ends, reading fails or the byte allowance is exceeded. | Discard staged data and end descriptor ownership. Never reopen the name to obtain a more convenient result. |
Treat deployment evidence as a separate requirement
Before implementation, review the actual kernel, userspace headers, architecture, sandbox policy, filesystem and store publisher together. A current manual page is not proof that the deployed build supports the chosen profile. Establish descriptor ownership so another task cannot close, reuse or share the handle unexpectedly; arrange cleanup on every exit.
This worksheet establishes no tested confinement, race resistance, timing bound or content safety. Documentation was read, but no Linux syscall, filesystem fixture, kernel inspection, model call or runtime experiment was performed. Keep downstream parsing and sensitive-data release checks separate.
Boundary is prelaunch. Its planned commercial request checks and its separate synthetic action demo do not provide this Linux file service. Use the broader file and shell guide for surrounding worker privileges and process boundaries.
Primary sources
Official references supporting the guidance. Examples in this guide are synthetic and are not reports of a production incident.