genpolicy: block all relative paths for copyFile requests

[Redent0r]

Merge Checklist

• Followed patch format from upstream recommendation: https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
  • Included a single commit in a given PR - at least unless there are related commits and each makes sense as a change on its own.
• Aware about the PR to be merged using "create a merge commit" rather than "squash and merge" (or similar)
• genPolicy only: Ensured the tool still builds on Windows
• genPolicy only: Updated sample YAMLs' policy annotations, if applicable
• The upstream-missing label (or upstream-not-needed) has been set on the PR.

Summary

This PR tightens the policy implementation with regards to directory traversal by prohibiting symlink sources that contain ...
It's worth noting this fix has been added to check_directory_traversals, which is used by 2 code paths:

• validates symlink source: this is the path where the change takes effect
• validate input path: No change in behavior as .. would fail subsequent regexp validation

Test Methodology

Tested locally using https://github.com/kata-containers/kata-containers/blob/main/src/tools/agent-ctl/README.md#examples.

Was able to see before this change how we can specify a copy file request with a symlink source pointing to ..

Was able to see after this change how specifying a copy file request gets blocked