fix(daemon): scope the /home log-path alias to FreeBSD only

private_log_directory_path_copy shared the /home root-owned alias
between __APPLE__ and __FreeBSD__. macOS never needed /home resolved
in this security-sensitive step; split the alias list so Darwin keeps
{/tmp, /var} and only FreeBSD gains /home -> /usr/home.

Signed-off-by: Pedro Ramos <131530838+pr9000@users.noreply.github.com>

Author: PR9000

src/daemon/ipc.c

@@ -1337,12 +1337,18 @@ static bool private_log_base_name_valid(const char *base_name) {
 }
 
 static char *private_log_directory_path_copy(const char *directory_path) {
-#ifdef __APPLE__
-    /* Darwin exposes the trusted top-level aliases /tmp -> /private/tmp and
-     * /var -> /private/var.  Resolve only those root-owned aliases before the
+#if defined(__APPLE__) || defined(__FreeBSD__)
+    /* Resolve only those root-owned aliases before the
      * component-wise O_NOFOLLOW walk.  Canonicalizing the complete caller path
      * would follow an attacker-controlled cache/log symlink and is forbidden. */
+#if defined(__APPLE__)
+    /* Darwin exposes the trusted top-level aliases /tmp -> /private/tmp and
+     * /var -> /private/var. */
     static const char *const aliases[] = {"/tmp", "/var"};
+#else
+    /* FreeBSD additionally exposes /home -> /usr/home as a root-owned alias. */
+    static const char *const aliases[] = {"/tmp", "/var", "/home"};
+#endif
     for (size_t index = 0; index < sizeof(aliases) / sizeof(aliases[0]); index++) {
         const char *alias = aliases[index];
         size_t alias_length = strlen(alias);