prepare-data-dir leaves files with a second name to their owner (closes #143)

A hard link in /data shares its owner with a file that can be anywhere
on the same filesystem, so chowning it gave that file to the netwatch
user. A regular file or symbolic link with more than one name now
keeps its owner and its path is logged.

Owners are now set on the opened directory, file or link after
checking it, as chmodDir sets modes, so a hard link swapped in
afterwards is caught. A symbolic link is opened without following it
and given to the netwatch user itself, as the server must own a link
it follows in a sticky directory anyone can write to. Other files,
such as devices, keep their owner.

Model: opus-5-5

bin/entrypoint.sh

@@ -66,10 +66,12 @@ done > /etc/nginx/trusted-proxies.conf
 # netwatch-server keeps its report files in DATA_DIR, on the /data
 # volume, which may be a host directory owned by root or by another
 # uid. Here, as root, netwatch-server prepare-data-dir creates DATA_DIR
-# and gives /data and everything in it to the netwatch user, so the
-# host directory needs no preparing. It stops the start, naming
+# and gives /data and the directories, regular files and symbolic links
+# in it to the netwatch user, so the host directory needs no preparing,
+# except a file with a second name (hard link), which keeps its owner,
+# as that name could be outside /data. It stops the start, naming
 # DATA_DIR, unless DATA_DIR is /data or a path below it, and it acts on
-# nothing outside /data, whatever symbolic links it meets there.
+# nothing outside /data, whatever symbolic or hard links it meets there.
 export DATA_DIR="${DATA_DIR:-/data/reports}"
 netwatch-server prepare-data-dir "$DATA_DIR" || exit 1