mbox series

[0/3] tools/thermal/tmon: Fix predictable temporary path /var/log/tmon.log

Message ID 20250509154435.14670-1-trenn@suse.de
Headers show
Series tools/thermal/tmon: Fix predictable temporary path /var/log/tmon.log | expand

Message

Thomas Renninger May 9, 2025, 3:44 p.m. UTC 
Wolfgang Frisch identified and reported:
tmon only runs as root and logs event to /var/tmp/tmon.log.
If fs.protected_symlinks=0, an unprivileged user can overwrite
arbitrary files on the system.

nobody@localhost:/var/tmp> ln -s /test/shadow tmon.log
root@localhost:/> tmon -l

I could reproduce the issue and after some discussion we came
to 3 possible solutions:
1. Use /var/log/tmon.log instead of world-readable /var/tmp
2. Add randomness to the file name, e.g. /var/log/tmon.log.QipZjI
3. Make /var/tmp/tmon.log safe (TM), or say more robust.

Wolfgang came up with a patch which is part of this submission.
His intention is to keep /var/tmp/tmon.log, in case other tools/scripts
or docs rely on it.

If 3. is a suitable solution, it would be great if someone could
pile these patches for next submission round.

Thanks,

       Thomas

Thomas Renninger (3):
  tools/thermal/tmon: Prevent symlink attack on log file
  tools/thermal/tmon: Make sure ctrl_cdev is a Null terminated string
  tools/thermal/tmon: Cleanup only: Use LOG_FILE vars

 tools/thermal/tmon/tmon.c | 57 +++++++++++++++++++++++++++------------
 tools/thermal/tmon/tmon.h |  3 ++-
 2 files changed, 42 insertions(+), 18 deletions(-)