Skip to content

[Security] Stage menu IPC files out of world-writable /tmp #10506

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Chessing234 wants to merge 1 commit into
base: quattro
Choose a base branch
from
+84 −8
Open

[Security] Stage menu IPC files out of world-writable /tmp #10506

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions bin/omarchy-menu-images
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,10 +72,12 @@ if (( ${#image_dirs[@]} == 0 )); then
exit 1
fi

selection_file=$(mktemp)
done_file=$(mktemp)
pending_file=$(mktemp)
pending_video_file=$(mktemp)
ipc_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}"
mkdir -m 700 -p "$ipc_dir"
selection_file=$(mktemp "$ipc_dir/omarchy-menu-images.XXXXXX")
done_file=$(mktemp "$ipc_dir/omarchy-menu-images.XXXXXX")
pending_file=$(mktemp "$ipc_dir/omarchy-menu-images.XXXXXX")
pending_video_file=$(mktemp "$ipc_dir/omarchy-menu-images.XXXXXX")
rm -f "$done_file"
trap 'rm -f "$selection_file" "$done_file" "$pending_file" "$pending_video_file"' EXIT

Expand Down
6 changes: 4 additions & 2 deletions bin/omarchy-menu-input
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,10 @@ while (( $# > 0 )); do
shift
done

selection_file=$(mktemp)
done_file=$(mktemp)
ipc_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}"
mkdir -m 700 -p "$ipc_dir"
selection_file=$(mktemp "$ipc_dir/omarchy-menu-input.XXXXXX")
done_file=$(mktemp "$ipc_dir/omarchy-menu-input.XXXXXX")
rm -f "$done_file"
trap 'rm -f "$selection_file" "$done_file"' EXIT

Expand Down
6 changes: 4 additions & 2 deletions bin/omarchy-menu-select
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,8 +67,10 @@ if (( ${#options[@]} == 0 )); then
exit 1
fi

selection_file=$(mktemp)
done_file=$(mktemp)
ipc_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}"
mkdir -m 700 -p "$ipc_dir"
selection_file=$(mktemp "$ipc_dir/omarchy-menu-select.XXXXXX")
done_file=$(mktemp "$ipc_dir/omarchy-menu-select.XXXXXX")
rm -f "$done_file"
trap 'rm -f "$selection_file" "$done_file"' EXIT

Expand Down
70 changes: 70 additions & 0 deletions test/shell.d/menu-ipc-path-test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
#!/bin/bash

set -euo pipefail

source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"

require_command perl

tmpdir=$(mktemp -d)
trap 'rm -rf "$tmpdir"' EXIT

runtime_dir="$tmpdir/runtime"
stub_bin="$tmpdir/bin"
ipc_log="$tmpdir/ipc.log"
mkdir -m 700 -p "$runtime_dir" "$stub_bin"

cat >"$stub_bin/omarchy-shell" <<'SH'
#!/bin/bash
payload="${@: -1}"
perl -MJSON::PP=decode_json -e '
my $p = decode_json($ARGV[0]);
my $sel = $p->{selectionFile};
my $done = $p->{doneFile};
die "missing ipc paths" unless defined $sel && defined $done;
if (defined $ENV{IPC_LOG}) {
open my $l, ">>", $ENV{IPC_LOG} or die $!;
print $l "$sel\n$done\n";
close $l;
}
open my $s, ">", $sel or die $!;
print $s "picked\n";
close $s;
open my $d, ">", $done or die $!;
close $d;
' "$payload"
SH
chmod +x "$stub_bin/omarchy-shell"

for cmd in omarchy-menu-select omarchy-menu-input omarchy-menu-images; do
if grep -E '^selection_file=\$\(mktemp\)$' "$ROOT/bin/$cmd"; then
fail "$cmd must not mktemp in the default /tmp"
fi
grep -Fq '${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}' "$ROOT/bin/$cmd" ||
fail "$cmd stages menu IPC under the runtime directory"
done
pass "menu helpers do not stage IPC files in world-writable /tmp"

: >"$ipc_log"
PATH="$stub_bin:$PATH" XDG_RUNTIME_DIR="$runtime_dir" IPC_LOG="$ipc_log" \
"$ROOT/bin/omarchy-menu-select" Prompt one >"$tmpdir/select.out"

[[ $(<"$tmpdir/select.out") == picked ]] ||
fail "menu-select still returns the chosen row" "$(<"$tmpdir/select.out")"
while IFS= read -r path; do
[[ $path == "$runtime_dir"/omarchy-menu-select.* ]] ||
fail "menu-select IPC path is under XDG_RUNTIME_DIR" "$path"
done <"$ipc_log"
pass "menu-select stages IPC under XDG_RUNTIME_DIR"

: >"$ipc_log"
PATH="$stub_bin:$PATH" XDG_RUNTIME_DIR="$runtime_dir" IPC_LOG="$ipc_log" \
"$ROOT/bin/omarchy-menu-input" Reminder >"$tmpdir/input.out"

[[ $(<"$tmpdir/input.out") == picked ]] ||
fail "menu-input still returns the typed value" "$(<"$tmpdir/input.out")"
while IFS= read -r path; do
[[ $path == "$runtime_dir"/omarchy-menu-input.* ]] ||
fail "menu-input IPC path is under XDG_RUNTIME_DIR" "$path"
done <"$ipc_log"
pass "menu-input stages IPC under XDG_RUNTIME_DIR"