fix(userspace): open pidfile with O_NOFOLLOW to prevent symlink TOCTOU

[alexmchughdev]

What type of PR is this?

/kind bug

What this PR does / why we need it:

Hardens the pidfile open path in userspace/falco/app/actions/pidfile.cpp against a symlink TOCTOU. Previously the pidfile was created via std::ofstream::open(), which has no portable O_NOFOLLOW equivalent. If an operator configures a pidfile path in a directory writable by an unprivileged user, that user could pre-place a symlink and trick a root-running Falco into clobbering an arbitrary file with the PID on startup.

The pidfile path is operator-controlled and typically lives in a root-owned directory like /var/run, so this is not exploitable in the standard threat model — this is a defence-in-depth fix.

The change replaces the std::ofstream open with a raw POSIX open() using O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW | O_CLOEXEC and writes the PID with dprintf. The open() will now fail with ELOOP if the path is a symlink. Error reporting goes through falco_strerror_r matching the pattern in create_signal_handlers.cpp. Behaviour is unchanged for legitimate users.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

• No behaviour change for legitimate operators — same path, same content (PID + newline), same exit(-1) on failure as before.
• The O_CLOEXEC flag is also added so the fd does not leak into any later forked program-output children.
• A short comment explains why O_NOFOLLOW is there so it is not removed during a future cleanup.

Does this PR introduce a user-facing change?:

fix(userspace): open the pidfile with O_NOFOLLOW to prevent a symlink TOCTOU when the pidfile path is in an attacker-writable directory

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: alexmchughdev
Once this PR has been reviewed and has the lgtm label, please assign lucaguerra for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[poiana]

Welcome @alexmchughdev! It looks like this is your first PR to falcosecurity/falco 🎉

[ekoops]

Hey @alexmchughdev , unfortunately this PR breaks windows build. Could you please take a look? https://github.com/falcosecurity/falco/actions/runs/25507407572/job/75014856179?pr=3871