diff --git a/fileutil/fileutil.go b/fileutil/fileutil.go
index b667696..cab5fda 100644
--- a/fileutil/fileutil.go
+++ b/fileutil/fileutil.go
@@ -3,6 +3,8 @@ package fileutil
 
 import (
 	"os"
+	"path/filepath"
+	"strings"
 
 	"golang.org/x/sys/unix"
 )
@@ -45,3 +47,10 @@ const (
 func Access(path string, mode int) error {
 	return unix.Access(path, uint32(mode))
 }
+
+// ValidateSymlink checks to make sure a symlink exists in some top-level
+// directory.
+func ValidateSymlink(symlink, topLevel string) bool {
+	target, err := filepath.EvalSymlinks(symlink)
+	return strings.HasPrefix(target, topLevel)
+}