stdbuf: fix tmpdir leak - #14059
Open
Ecordonnier wants to merge 4 commits into
Open
Conversation
Two security/correctness issues reported in uutils#13939: 1. Leaked temporary directories: using exec() replaced the stdbuf process before TempDir's destructor could run, leaving one .tmp* directory per invocation in $TMPDIR forever. Fix: use spawn() + wait() so the parent process survives to drop the TempDir after the child exits. 2. World-readable temporary directory: the tmpdir was created with default permissions, making libstdbuf.so writable by any user on a multi-user system (privilege-escalation risk). Fix: call set_permissions(0o700) immediately after creation, bypassing the umask. Both fixes apply only when feat_external_libstdbuf is not set (i.e. the embedded .so path).
Use tempfile::Builder::permissions so the directory is never world-accessible between tempdir() and chmod, closing a TOCTOU window on permissive umasks. Co-authored-by: Cursor <cursoragent@cursor.com>
Open the injected shared library with an explicit mode so umask 0 cannot leave a world-writable .so in the private temp directory. Co-authored-by: Cursor <cursoragent@cursor.com>
Point at rust-lang/cargo#8317 as the still-open request for cargo install to support installing shared libraries, since that's the root cause of the /tmp fallback described in the comment above. Co-authored-by: Cursor <cursoragent@cursor.com>
|
GNU testsuite comparison: |
Merging this PR will improve performance by 5.48%
|
| Mode | Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|---|
| ⚡ | Simulation | du_summarize_balanced_tree[(5, 4, 10)] |
16.9 ms | 16 ms | +5.48% |
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing Ecordonnier:stdbuf-fix-tmpdir-leak (3a8ae04) with main (3d09364)
Footnotes
-
50 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
Contributor
|
Can we reuse a directory named |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two security/correctness issues reported in #13939:
Leaked temporary directories: using exec() replaced the stdbuf process before TempDir's destructor could run, leaving one .tmp* directory per invocation in $TMPDIR forever.
Fix: use spawn() + wait() so the parent process survives to drop the TempDir after the child exits.
World-readable temporary directory: the tmpdir was created with default permissions, making libstdbuf.so writable by any user on a multi-user system (privilege-escalation risk).
Fix: call set_permissions(0o700) immediately after creation, bypassing the umask.
Both fixes apply only when feat_external_libstdbuf is not set (i.e. the embedded .so path).