Tenant Isolation

static/nginx/nginx.conf

@@ -59,19 +59,10 @@ http {
     open_file_cache_min_uses       2;
     open_file_cache_errors         on;
 
-    # Symlink backstop for tenant static files. Enforced by nginx at the SAME
-    # open() that serves the file, so it complements the tenant_isolation patch
-    # (docs/tenant-isolation.md) on the axes that patch cannot cover from its
-    # separate openat2 probe:
-    #   * the probe->open TOCTOU window — a tenant that swaps a benign file for an
-    #     escaping symlink after the probe is still caught here, at serve time;
-    #   * the open paths the patch does not intercept — gzip_static, autoindex,
-    #     dav, mp4/flv — which all funnel through this same disable_symlinks check.
-    # `if_not_owner` (not `on`) is deliberate: it permits a tenant's OWN in-tree
-    # symlinks (e.g. Laravel's public/storage) while refusing a symlink whose
-    # target has a different owner (docroot/x -> /etc/passwd, root-owned => 403),
-    # which matches the tenant_isolation semantics. `from=$document_root` skips
-    # symlink checks on the docroot prefix itself (owned by the platform).
+    # Symlink backstop for tenant_isolation, checked at the serving open(): catches
+    # the probe->open race and the paths the patch skips (gzip_static, autoindex,
+    # dav, mp4/flv). if_not_owner allows a tenant's own symlinks, blocks ones whose
+    # target has a different owner (docroot/x -> /etc/passwd => 403).
     disable_symlinks               if_not_owner from=$document_root;
 
     # ===================== TLS ============================ #