fix(provision): guard chown target against filesystem root in init-container

In a k8s init container only the workspace dir is mounted (subPath), so
filepath.Dir(HostPath) resolves to "/" for HostPath=/workspace — the chown
would recurse over the entire container root (chown -R 1000:1000 /). Today it's
masked by dropped capabilities + a non-root security context (chown fails
silently, provisioning still succeeds), but it's a correctness defect and a
latent security hazard if that security context is ever relaxed.

Extract the target computation into a testable chownTarget() helper that falls
back to the workspace dir itself when the parent is "/" or ".", preserving
broker-side behavior (chown the project root). Add unit coverage.

Review finding from PR #172 (medium severity, required fix).

Author: ptone

pkg/provision/provision.go

@@ -215,9 +215,8 @@ func ProvisionShared(in ProvisionInput) error {
 
 	// Chown to stable NFS UID/GID (design §9.1). This is a ONE-TIME operation
 	// under the advisory lock — per-start chown is skipped for NFS (see N1-5).
-	// Chown the workspace dir itself (sentinelDir may differ from project root
-	// when running inside a k8s init container with a subPath mount).
-	chownRoot := filepath.Dir(in.Resolved.HostPath)
+	//
+	chownRoot := chownTarget(in.Resolved.HostPath)
 	uid, gid := resolveUID(in), resolveGID(in)
 	if err := chownProjectTree(chownRoot, uid, gid); err != nil {
 		slog.Warn("nfsBackend.Provision: chown failed (non-fatal, may lack privileges)",
@@ -405,6 +404,23 @@ func sanitizeBranchName(name string) string {
 	return result
 }
 
+// chownTarget returns the directory to recursively chown for a freshly
+// provisioned workspace.
+//
+// Broker-side, the project root is the parent of the workspace dir (it also
+// holds the shared-dirs siblings), so we chown the parent. But inside a k8s
+// init container only the workspace dir itself is mounted (subPath), so its
+// parent resolves to the filesystem root "/". Chowning "/" recursively is
+// wrong — and a latent security hazard if the pod's security context is ever
+// relaxed — so fall back to chowning the workspace dir itself in that case.
+func chownTarget(hostPath string) string {
+	parent := filepath.Dir(hostPath)
+	if parent == "/" || parent == "." {
+		return hostPath
+	}
+	return parent
+}
+
 // chownProjectTree sets ownership of the project root and its contents to the
 // given UID/GID. This is a ONE-TIME operation done under the advisory lock
 // during first provisioning (design §9.1). Per-start chown is NOT done for

pkg/provision/provision_test.go

@@ -98,6 +98,30 @@ func TestSanitizeBranchName(t *testing.T) {
 	}
 }
 
+func TestChownTarget(t *testing.T) {
+	tests := []struct {
+		name     string
+		hostPath string
+		want     string
+	}{
+		// Broker-side: chown the project root (parent of the workspace dir).
+		{"broker project root", "/srv/nfs/share1/proj-abc/workspace", "/srv/nfs/share1/proj-abc"},
+		// k8s init container subPath mount: parent is "/", fall back to the
+		// workspace dir itself rather than chown -R the whole container root.
+		{"k8s workspace mount", "/workspace", "/workspace"},
+		// Relative path has no real parent ("."); fall back to the path itself.
+		{"relative path", "workspace", "workspace"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := chownTarget(tt.hostPath); got != tt.want {
+				t.Errorf("chownTarget(%q) = %q, want %q", tt.hostPath, got, tt.want)
+			}
+		})
+	}
+}
+
 // --- writeSentinel ---
 
 func TestWriteSentinel_Atomic(t *testing.T) {