1.5 KiB
1.5 KiB
| id | status | status_updated | status_note | component | severity | timestamp | last_seen | occurrences | files | tags | related | fix_commits | legacy | gitea_issue | gitea_synced_status | gitea_synced_hash | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bug-1868 | fixed | 2026-09-26 | 7864a3da: xcecd_create_job_output() unlinks then creates with O_EXCL|O_NOFOLLOW|O_CLOEXEC. |
worker | security | 2026-09-26T07:40:17Z | 2026-09-26T07:40:17Z | 1 |
|
|
|
|
true | 288 | fixed | a6d6a8485b1c |
bug-1868: uv_proc_exec (worker/src/uv_proc.c) creates each task's output file /tmp/job__task.out…
Description
uv_proc_exec (worker/src/uv_proc.c) creates each task's output file /tmp/job__task.out as root with O_WRONLY|O_CREAT|O_TRUNC and no O_NOFOLLOW/O_EXCL: a local user who pre-plants a symlink at a predictable future job's output name makes the root worker truncate and write job output into the symlink target
Environment
Not recorded (migrated from buglog.json).
Reproduction
Not recorded (migrated from buglog.json).
Root cause
Predictable name in world-writable /tmp opened by root following symlinks. Only mitigated by the host's fs.protected_symlinks / fs.protected_regular sysctls, not by the code. Sibling of bug-1508 (read side, fixed in 7723a4f4).
Fix
Not recorded (migrated from buglog.json).
Verification
Not recorded (migrated from buglog.json).
References
- Related: bug-1508
- Gitea: #288