Tenant Isolation

static/nginx/nginx.conf

@@ -59,6 +59,21 @@ http {
     open_file_cache_min_uses       2;
     open_file_cache_errors         on;
 
+    # Symlink backstop for tenant static files. Enforced by nginx at the SAME
+    # open() that serves the file, so it complements the tenant_isolation patch
+    # (docs/tenant-isolation.md) on the axes that patch cannot cover from its
+    # separate openat2 probe:
+    #   * the probe->open TOCTOU window — a tenant that swaps a benign file for an
+    #     escaping symlink after the probe is still caught here, at serve time;
+    #   * the open paths the patch does not intercept — gzip_static, autoindex,
+    #     dav, mp4/flv — which all funnel through this same disable_symlinks check.
+    # `if_not_owner` (not `on`) is deliberate: it permits a tenant's OWN in-tree
+    # symlinks (e.g. Laravel's public/storage) while refusing a symlink whose
+    # target has a different owner (docroot/x -> /etc/passwd, root-owned => 403),
+    # which matches the tenant_isolation semantics. `from=$document_root` skips
+    # symlink checks on the docroot prefix itself (owned by the platform).
+    disable_symlinks               if_not_owner from=$document_root;
+
     # ===================== TLS ============================ #
     ssl_protocols                  TLSv1.2 TLSv1.3;
     ssl_prefer_server_ciphers      off;