logs: teach the file tailer/fingerprinter to honor NoFollow

Add a NoFollow bool field to LogsConfig (never parsed from user config -
mapstructure/yaml/json "-") and wire it through every place that opens a log
file for tailing:

- FileOpener interface (pkg/logs/util/opener) gains OpenLogFileNoFollow,
  implemented on Linux via privilegedlogsclient.OpenNoFollow and falling back
  to a plain open on other platforms (symlink rejection is only meaningful
  for /proc/<pid>/fd-derived paths, which are Linux-only).
- The file tailer (pkg/logs/tailers/file/tailer.go) routes every open site
  (initial open, rotation re-open) through a new openLogFile() helper that
  picks the no-follow variant based on Source.Config().NoFollow.
  ReplaceSource refreshes this from the new source.
- The fingerprinter (fingerprint.go) does the same for its own open site.
- pkg/logs/launchers/container/tailerfactory/file.go propagates
  source.Config.NoFollow into the docker/k8s FileSource constructors. This is
  needed here (not deferred to a later change) because
  TestLogsConfigFieldCoverage in that package's test file asserts every
  LogsConfig field is either copied or explicitly excluded - it fails the
  moment NoFollow exists as a field without being handled.

Nothing sets NoFollow=true yet in this PR - this is generic plumbing,
exercised only by tests that construct LogsConfig{NoFollow: true} explicitly.
The field is deliberately unreachable from real config parsing
(mapstructure/yaml/json "-"). The next (and final) PR in this stack sets
cfg.NoFollow = true in the AD scheduler specifically for names.ProcessLog
sources and switches process_log's file-readability check over to the
no-follow client call - that's what actually activates the protection this
PR builds the mechanism for.

Part of a stack towards DSCVR-475; split out of PR #51746 for easier review.
Depends on the privileged-logs NoFollow transport PR.

Environment: Datadog workspace

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-authored-by: Vincent Whitchurch <vincent.whitchurch@datadoghq.com>

Author: vitkyrka

comp/logs/agent/config/integration_config.go

@@ -147,6 +147,12 @@ type LogsConfig struct {
 	IntegrationSource string `mapstructure:"integration_source" json:"integration_source" yaml:"integration_source"`
 	// IntegrationFileIndex is the index of the integration file that contains this source.
 	IntegrationSourceIndex int `mapstructure:"integration_source_index" json:"integration_source_index" yaml:"integration_source_index"`
+
+	// NoFollow is true when this file source must not follow symlinks.  Set by the AD
+	// scheduler for sources discovered by the process_log provider, whose paths come from
+	// /proc/<pid>/fd and are canonical at discovery time — any symlink found later
+	// indicates an attacker-controlled swap.  Never parsed from config.
+	NoFollow bool `json:"-" yaml:"-" mapstructure:"-"`
 }
 
 // SourceAutoMultiLineOptions defines per-source auto multi-line detection overrides.

pkg/logs/internal/util/opener/open_linux.go

@@ -17,6 +17,12 @@ func OpenLogFile(path string) (*os.File, error) {
 	return privilegedlogsclient.Open(path)
 }
 
+// OpenLogFileNoFollow opens a file with the privileged logs client without
+// following symbolic links in any path component.
+func OpenLogFileNoFollow(path string) (*os.File, error) {
+	return privilegedlogsclient.OpenNoFollow(path)
+}
+
 // StatLogFile stats a log file with the privileged logs client
 func StatLogFile(path string) (os.FileInfo, error) {
 	return privilegedlogsclient.Stat(path)

pkg/logs/internal/util/opener/open_other.go

@@ -14,11 +14,22 @@ import (
 	"github.com/DataDog/datadog-agent/pkg/util/filesystem"
 )
 
-// OpenLogFile opens a file with filesystem.OpenShared
+// OpenLogFile opens a file with filesystem.OpenShared.
+// On non-Linux platforms we don't need to support symlink rejection since it's
+// only needed for process_log-discovered paths which are currently only
+// supported on Linux.
 func OpenLogFile(path string) (*os.File, error) {
 	return filesystem.OpenShared(path)
 }
 
+// OpenLogFileNoFollow falls back to a regular open on non-Linux platforms:
+// symlink rejection is only needed for process_log-discovered paths, and
+// process_log discovery (based on /proc/<pid>/fd) is Linux-only, so this path
+// is not reachable with an untrusted, attacker-controlled symlink swap here.
+func OpenLogFileNoFollow(path string) (*os.File, error) {
+	return filesystem.OpenShared(path)
+}
+
 // StatLogFile stats a log file
 func StatLogFile(path string) (os.FileInfo, error) {
 	return os.Stat(path)

pkg/logs/launchers/container/tailerfactory/file.go

@@ -122,7 +122,9 @@ func (tf *factory) makeDockerFileSource(source *sources.LogSource) (*sources.Log
 	}
 
 	// check access to the file; if it is not readable, then returning an error will
-	// try to fall back to reading from a socket.
+	// try to fall back to reading from a socket.  Container log paths (e.g.
+	// /var/log/pods/…) are symlinks created by the container runtime intentionally,
+	// so symlink-following is correct here.
 	f, err := opener.OpenLogFile(path)
 	if err != nil {
 		// (this error already has the form 'open <path>: ..' so needs no further embellishment)
@@ -155,6 +157,7 @@ func (tf *factory) makeDockerFileSource(source *sources.LogSource) (*sources.Log
 		AutoMultiLineSamples:          source.Config.AutoMultiLineSamples,
 		ExperimentalAdaptiveSampling:  source.Config.ExperimentalAdaptiveSampling,
 		ExperimentalNoisyLogDetection: source.Config.ExperimentalNoisyLogDetection,
+		NoFollow:                      source.Config.NoFollow,
 	})
 
 	// inform the file launcher that it should expect docker-formatted content
@@ -276,6 +279,7 @@ func (tf *factory) makeK8sFileSource(source *sources.LogSource) (*sources.LogSou
 			AutoMultiLineSamples:          source.Config.AutoMultiLineSamples,
 			ExperimentalAdaptiveSampling:  source.Config.ExperimentalAdaptiveSampling,
 			ExperimentalNoisyLogDetection: source.Config.ExperimentalNoisyLogDetection,
+			NoFollow:                      source.Config.NoFollow,
 		})
 
 	switch source.Config.Type {

pkg/logs/launchers/file/BUILD.bazel

@@ -62,6 +62,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:android": [
@@ -98,6 +99,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:dragonfly": [
@@ -115,6 +117,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:freebsd": [
@@ -132,6 +135,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:illumos": [
@@ -149,6 +153,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:ios": [
@@ -166,6 +171,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:js": [
@@ -183,6 +189,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:linux": [
@@ -219,6 +226,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:openbsd": [
@@ -236,6 +244,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:osx": [
@@ -253,6 +262,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:plan9": [
@@ -270,6 +280,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:qnx": [
@@ -287,6 +298,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "@rules_go//go/platform:solaris": [
@@ -304,6 +316,7 @@ dd_agent_go_test(
             "//pkg/logs/tailers",
             "//pkg/logs/util/opener",
             "//pkg/logs/util/testutils",
+            "@com_github_stretchr_testify//require",
             "@com_github_stretchr_testify//suite",
         ],
         "//conditions:default": [],

pkg/logs/launchers/file/launcher_privileged_logs_test.go

@@ -78,6 +78,10 @@ func (s *PrivilegedLogsTestSetupStrategy) Setup(t *testing.T) TestSetupResult {
 			return privilegedlogstest.WithParentPermFixup(t, name, func() error {
 				return os.Remove(name)
 			})
+		}, symlink: func(oldname, newname string) error {
+			return privilegedlogstest.WithParentPermFixup(t, newname, func() error {
+				return os.Symlink(oldname, newname)
+			})
 		}}}
 }
 
@@ -99,6 +103,17 @@ func TestPrivilegedLogsLauncherTestSuiteWithConfigID(t *testing.T) {
 	suite.Run(t, s)
 }
 
+// TestPrivilegedLogsLauncherNoFollowSymlink runs the NoFollow symlink policy
+// test (defined in launcher_test.go) against the privileged-logs path.  The files
+// live in unsearchable directories, so the unprivileged open fails and the launcher
+// falls back to system-probe; the swapped symlink must be rejected there with
+// O_NOFOLLOW rather than followed.
+func TestPrivilegedLogsLauncherNoFollowSymlink(t *testing.T) {
+	strategy := &PrivilegedLogsTestSetupStrategy{}
+	res := strategy.Setup(t)
+	runLauncherNoFollowSymlinkTest(t, res.TestOps, res.TestDirs[0])
+}
+
 func TestPrivilegedLogsLauncherScanStartNewTailer(t *testing.T) {
 	setup := setupPrivilegedLogsTest(t)
 	runLauncherScanStartNewTailerTest(t, setup.tempDirs[:])