fix(sandbox): allow non-directory read_write entries like /dev/null

The symlink guard incorrectly rejected all non-directory entries.
Character devices like /dev/null are legitimate read_write paths
used in sandbox policies. Only reject symlinks, which are the
actual attack vector for the chown privilege escalation.

Refs: #350

Author: johntmyers

crates/openshell-sandbox/src/lib.rs

@@ -1208,20 +1208,15 @@ fn prepare_filesystem(policy: &SandboxPolicy) -> Result<()> {
     // The TOCTOU window between lstat and chown is not exploitable because
     // no untrusted process is running yet (the child has not been forked).
     for path in &policy.filesystem.read_write {
-        // Check for symlinks or non-directory files before touching the path.
+        // Check for symlinks before touching the path.  Character/block devices
+        // (e.g. /dev/null) are legitimate read_write entries and must be allowed.
         if let Ok(meta) = std::fs::symlink_metadata(path) {
             if meta.file_type().is_symlink() {
                 return Err(miette::miette!(
                     "read_write path '{}' is a symlink — refusing to chown (potential privilege escalation)",
                     path.display()
                 ));
             }
-            if !meta.file_type().is_dir() {
-                return Err(miette::miette!(
-                    "read_write path '{}' exists but is not a directory — refusing to chown",
-                    path.display()
-                ));
-            }
         } else {
             debug!(path = %path.display(), "Creating read_write directory");
             std::fs::create_dir_all(path).into_diagnostic()?;