diff options
| author | Ali Ahmet MEMIS <dev@unknownbbqr.xyz> | 2026-04-26 08:09:28 -0700 |
|---|---|---|
| committer | Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> | 2026-06-02 10:39:45 -0700 |
| commit | 607af438e6430893a822964c841a1994b33acccc (patch) | |
| tree | 9401f9875d5bc2aaf76fa95798a2d9a319c71f80 /tools | |
| parent | a167ae8eace52dd6c80438b77d92450fe12cd4be (diff) | |
| download | linux-next-607af438e6430893a822964c841a1994b33acccc.tar.gz linux-next-607af438e6430893a822964c841a1994b33acccc.zip | |
tools/power/x86/intel-speed-select: Harden daemon pidfile open
Avoid symlink-based pidfile clobbering by opening the pidfile with
O_NOFOLLOW and validating it with fstat() before locking/writing.
The daemon currently uses a fixed pidfile path under /tmp. A local
unprivileged user can pre-create a symlink at that path and cause a
root-run daemon instance to write into an attacker-chosen file.
Fixes: 7fd786dfbd2c ("tools/power/x86/intel-speed-select: OOB daemon mode")
Signed-off-by: Ali Ahmet MEMIS <dev@unknownbbqr.xyz>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: stable@kernel.org
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/power/x86/intel-speed-select/isst-daemon.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/tools/power/x86/intel-speed-select/isst-daemon.c b/tools/power/x86/intel-speed-select/isst-daemon.c index 66df21b2b573..acedb7432849 100644 --- a/tools/power/x86/intel-speed-select/isst-daemon.c +++ b/tools/power/x86/intel-speed-select/isst-daemon.c @@ -148,6 +148,7 @@ static void daemonize(char *rundir, char *pidfile) { int pid, sid, i; char str[10]; + struct stat st; struct sigaction sig_actions; sigset_t sig_set; int ret; @@ -200,11 +201,17 @@ static void daemonize(char *rundir, char *pidfile) if (ret == -1) exit(EXIT_FAILURE); - pid_file_handle = open(pidfile, O_RDWR | O_CREAT, 0600); + pid_file_handle = open(pidfile, O_RDWR | O_CREAT | O_NOFOLLOW, 0600); if (pid_file_handle == -1) { /* Couldn't open lock file */ exit(1); } + + if (fstat(pid_file_handle, &st) == -1) + exit(1); + + if (!S_ISREG(st.st_mode)) + exit(1); /* Try to lock file */ #ifdef LOCKF_SUPPORT if (lockf(pid_file_handle, F_TLOCK, 0) == -1) { |