Repository navigation
🐛 fix(unix): decide root redirect by effective uid - #666
Merged
Merged
Conversation
use_site_for_root checked the real uid, while docs/howto.rst tells callers to enable it when os.geteuid() == 0. A setuid-root process (real uid of the caller, effective uid 0) got the caller's home directories and created root-owned directories there. The runtime directory name and owner check used the real uid too, so such a process accepted the caller's /run/user/<uid> as its own. All three now use the effective uid, which owns what the process creates and matches Qt's checkXdgRuntimeDir. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-OARVZZ26.
gaborbernat
added
bug
…ive-uid # Conflicts: # tests/test_unix.py
…ive-uid # Conflicts: # src/platformdirs/unix.py # tests/test_api.py
…ive-uid # Conflicts: # docs/explanation.rst
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #673.
_use_sitecheckedgetuid() == 0, the real uid, whiledocs/howto.rsttells callers to passuse_site_for_root=Truewhenos.geteuid() == 0. A program started through a setuid-root launcher, with the caller's real uid and effective uid 0, followed the docs and still got the caller's~/.configand otheruser_*directories, created root-owned directories there, and searched them before/etc/xdg. With this PR the redirect, the runtime directory names and the runtime owner check use the effective uid.The root redirect read the real uid
A setuid executable keeps the caller's real uid and runs with the file owner's effective uid (
credentials(7)), andgetuid()returns the real one (getuid(2))._use_sitetherefore returnedFalsefor such a process, and everyuser_*property,place_*_fileandfind_*_fileresolved under the caller's home. Directories it created there were owned by uid 0, since ownership follows the effective uid._use_sitenow checksgeteuid(), the same test the how-to gives.The runtime directory used the real uid
/run/user/<uid>,runtime-<uid>and the owner check in_runtime_dir_problemused the real uid, so a setuid-root process accepted the caller's/run/user/1000as its private runtime directory._runtime_dir_problemfollows Qt'scheckXdgRuntimeDir, which usesgeteuid()for both the owner check and the fallback name. The names and the owner check now use the uid that owns what the process creates.Behavior changes
Processes whose real and effective uid agree, including anything started by
sudo,su,pkexec,doasor a service manager, see no change. A setuid-root process withuse_site_for_root=Truenow gets the site directories, and its runtime directory falls back to/run/user/0orruntime-0instead of the caller's. A process that started as root and lowered only its effective uid now gets the user directories instead of the site ones. The home directory lookup whenHOMEis unset still uses the real uid, matchingos.path.expanduser; with the redirect fixed it only applies to directories that are not redirected, such as the media directories.Reported by Anthropic's OSS Scanner: ANT-2026-OARVZZ26.