secure_dir and the write-ahead log's create_dir read ownership off whether set_permissions returned an error, which succeeds for a process holding CAP_FOWNER, and followed a symlink planted at the path. Both now stat with symlink_metadata, compare the owner against the uid this process creates files as, refuse a directory whose sticky bit marks it as shared, and say so in the log when they do tighten one. Change-Id: I25df3e581cdb9fccf89f3682a42c991ee84c0e9a