install: post-copy finalization reopens destination by path, allowing symlink-swap redirection

install safely creates the destination file relative to a parent directory fd, but then falls back to path-based post-copy finalization on the original destination pathname.

That finalization path includes --strip-program, chmod, timestamp updates, and some SELinux handling. If an attacker can replace the destination leaf with a symlink after the copy step but before finalization, those later operations can be redirected to a different file.

This is reproducible with install -s --strip-program ...: a delayed strip helper gives enough time to swap dest to dest -> victim, and the helper then writes to victim instead of the file install created.

Impact:

• Real TOCTOU vulnerability on Unix
• High risk when install is used in a privileged workflow
• The safe write phase and the finalization phase do not stay bound to the same inode

Root cause:

• Safe create/write by fd
• Unsafe finalization by pathname

Suggested fix:

• Keep the destination file open through finalization
• Perform strip/metadata updates via that file handle
• Reject destination path changes before success
• Use O_NOFOLLOW | O_EXCL for fd-based destination creation

Start at the install implementation's fd-based destination creation and path-based post-copy finalization, especially the --strip-program flow. Reproduce the symlink swap with a delayed strip helper, then trace chmod, timestamp, and SELinux handling. Done means finalization remains bound to the created file and destination path changes cannot redirect operations.