security: harden session directory, stale-socket unlink, and clear path

[babs]

Three related local-attack hardenings, one per commit. Each is independent and small enough to revert in isolation.

1. Validate session directory ownership and mode

expand_sockname() calls mkdir(dir, 0700) and ignores the return value. On the /tmp/.<progname>-<uid> fallback path (taken when \$HOME is unset or /), a hostile local user can pre-create that directory with permissive modes (or as a symlink) before the victim runs atch — every subsequent socket and .log lands under attacker control.

Fix: after mkdir, lstat the directory and refuse to proceed unless it is a real directory (not a symlink) owned by the current uid with mode 0700.

Also adds O_NOFOLLOW to the master's session-log open. Defense in depth: with the directory check in place the dir contents are already user-only, but O_NOFOLLOW also blocks any same-uid process that plants a symlink between mkdir and open.

2. Stat before unlinking stale session socket

cmd_open and the legacy -A mode call unlink(sockname) unconditionally when connect() returns ECONNREFUSED. With the directory check this is no longer cross-user-reachable, but the TOCTOU between the failed connect and the unlink is still a sharp edge.

Fix: lstat the path and unlink only if it's really a unix socket owned by the current uid.

3. Copy session name from env in cmd_clear, O_NOFOLLOW the log

cmd_clear stored a const char * returned by getenv() into the global char *sockname via a cast that drops const — undefined behavior if any future code path mutates sockname. Duplicate the chosen ancestry segment into owned storage instead.

Open the log with O_NOFOLLOW for the same reason as commit 1: refuse to truncate via a symlink.

Test plan

• make clean (no new warnings)
• sh tests/test.sh ./atch — 228/229 (the one failing test fails on main too; unrelated)
• Manual negative tests pass:
  • Pre-create ~/.cache/atch mode 0755 → atch refuses with clear message
  • Plant ~/.cache/atch/x.log → /tmp/target symlink, run atch clear x → refused (ELOOP), target untouched
  • Plant ~/.cache/atch/x.log → /tmp/target symlink, run atch start x … → log open silently disabled (existing best-effort behavior), target untouched

Notes

• No new dependencies, no behavior change for the normal \$HOME/.cache/<progname>/ path with default mode 0700.
• Existing setups with a wider mode on the session dir will start refusing — that's the intended security boundary, but worth calling out for downstream packagers.
• Three other findings from the same audit (arbitrary signal via MSG_KILL, raw escape replay on attach/tail, tail -f blind to log rotation) are not included here; happy to send follow-up PRs if you want them.