[flatstik]

Fixes #1973.

The protected mount point check (CVE-2025-23021) compared the unresolved path when realpath() failed, that is, when the mount point did not exist yet, so a new mount point reaching a protected directory through .. or a symbolic link passed. Every path starting with the default prefix was then created with mkdir(), chowned and later removed by pathname, following the same .. or link.

• IsProtectedSystemDirectory and IsDirectoryOnUserPath resolve the longest existing part of the mount point and append the rest. A mount point whose missing part contains . or .. is refused, since it cannot be checked.
• Only exact default mount points (<prefix>N, IsDefaultMountPoint) are created, chowned and removed, and used to derive the slot, instead of every path starting with the prefix.
• A default mount point is created with mkdirat() in a parent directory that only root can change (checked with fstat() on its descriptor), opened without following links and given to the user with fchown(), as the FUSE-T auxiliary directories are handled, so the path is not resolved again between the checks, mkdir() and chown(). A prefix whose parent other users can change (through VERACRYPT_MOUNT_PREFIX) is refused instead of creating mount points there.

The macOS path is unchanged: it does not create mount points itself.

Tested with Tests/test_linux_mount_point_protection.py (new, run in the Linux workflow), both reproductions from the issue plus an existing directory inside a mounted volume as mount point and a default mount point:

• with this change, all checks pass on ubuntu-24.04 and ubuntu-26.04: https://github.com/flatstik/VeraCrypt/actions/runs/40607482138
• on master with only the test, the favorite with .. mounts under /etc on both, and the link fails on ubuntu-24.04: https://github.com/flatstik/VeraCrypt/actions/runs/40607484485

Not tested on FreeBSD or OpenBSD, which share the mount point creation.

[idrassi]

Thanks for working on this. I assigned the issue to myself when it was opened to let people know I was working on it, though that was probably easy to miss. So, I had already started on my fix before you opened this PR, and I have now pushed it as d18cb6f.

Your test complements mine by exercising real mounts as root, so I have cherry picked it as 9d599af, preserving your authorship. I ran it against my fix and all checks passed. Thanks for adding that coverage.

[flatstik]

Thanks for taking the test, and sorry for missing that the issue was assigned to you. I will check assignees before starting on an issue.