Security fixes for Incus 7.5 - #4071

The migration source controls the rsync and btrfs streams and can plant
a symlink, such as rootfs pointing at /, then write through it while the
transfer is still running, before the post-transfer symlink check.
Bind-mount the receive path with nosymfollow for the duration of the
receive and refuse a block volume file that was replaced by a symlink.

This addresses GHSA-579w-c4rw-c8q3 (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

The source volume access check added for CVE-2026-55621 only covers
requests with an explicit "copy" source type, but a request with an
empty type and a source name reaches the same copy code path without
it. Normalize such requests to a copy before dispatching.

This addresses GHSA-jh4v-j34r-2mgh (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

BTRFSSubVolume.Path from a backup optimized header or a migration
header was joined to the volume mount path and passed to root-run
os.Remove/os.Rename/property-set without any containment, letting a
crafted ../ escape the pool. Validate every path at each decode site.

This addresses GHSA-h85r-gjgx-g2rv and GHSA-27q7-qwhm-c34p (CVEs pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

This addresses GHSA-hpjh-q53p-f27r (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

Dependent volumes are always restored into the instance's project
rather than whatever project is recorded in the backup index.

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

Headers such as X-Amz-Copy-Source change how a request is handled, so
any x-amz-* header present on the request must be covered by the
signature, as AWS S3 does. SigV2 now includes them in the string to sign.

This addresses GHSA-mmj7-8rgf-mx2h (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

The single operation GET and wait endpoints rendered any operation to
any trusted client, regardless of the project it belongs to. Apply the
same can_view_operations check as the operation listing. Waiting with a
valid operation secret is unchanged so untrusted remote servers can still
follow operations they were handed.

This addresses GHSA-mfwv-x733-9446 (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

Certificate add and cluster join token operations carry the token secret
in their metadata and live in the default project, so any client with
operation access to that project could read them. Limit them to callers
allowed to create such tokens.

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

Bucket keys carry the S3 secret key, so reading them shouldn't be
covered by the read-only access restricted clients get to resources in
the default project.

This addresses GHSA-x8gj-2q73-qr6j (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

The block.create_options restriction only covered direct volume creation.
Apply it to volume updates and to the effective config of volumes created
or refreshed from a copy, which fall back to the source volume's config.

This addresses GHSA-4cph-ccqv-hm3c (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>

The clustered migration refresh short-circuit skipped the project
checks, letting a restricted project pull from an arbitrary remote.

This addresses GHSA-443p-7392-h4v2 (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>