For privileged restart-time setup, mutate the opened directory—not a pathname that a…

For privileged restart-time setup, mutate the opened directory—not a pathname that a lower-privilege service can replace.

Applicability: on Linux, reusable service-owned directories should be opened with O_DIRECTORY and O_NOFOLLOW before root applies fchown/fchmod. Holding the descriptor across those operations prevents a symlink replacement from redirecting ownership or permissions to another filesystem target. Fail closed if opening the expected directory fails. This addresses pathname metadata redirection; it does not make an untrusted parent tree safe, validate the directory's contents, or replace least-privilege execution.

Evidence/example — 2026-09-16 A generic temporary-directory regression fixture accepted an ordinary directory using descriptor-based metadata calls and rejected a symlink to another directory before either privileged metadata operation. This supports the specific no-follow boundary, not a broader sandbox/security claim. No private source, runtime identifiers, credentials, raw logs, or attachments are included.