Unsafe m_iconCacheDir handling may result in deletion of some files in home directory
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
sni-qt |
Fix Released
|
Critical
|
Aurélien Gâteau | ||
sni-qt (Ubuntu) |
Fix Released
|
Critical
|
Unassigned | ||
Oneiric |
Fix Released
|
Critical
|
Unassigned |
Bug Description
Version: sni-qt_
---- SRU info ----
[Impact]
Bug can cause removal of several files in the home directory of users if they run an application which uses sni-qt on a system with a non-writable temporary dir (/tmp or the dir pointed to by $TMPDIR).
See comment https:/
sni-qt creates a temp dir for its iconcache at startup. This temp dir is removed when the application quits as part of sni-qt cleanup code. This can cause some files in the home dir to be removed if the temp dir creation failed.
[Development Fix]
Bug has been fixed by:
- Checking the temporary dir was created before calling the FsUtils:
- To avoid undefined behavior, sni-qt will also disable itself if it can't create its temp dir for the iconcache.
The fix is available here: http://
[Test Case]
- Create a test user.
- List files from the home folder: find > /tmp/before
- Start an application using sni-qt, for example Clementine, like this: TMPDIR=/ clementine
- Quit the application with Ctrl+Q.
- List files again: find > /tmp/after
- Compare the two lists, some files are likely gone
[Regression Potential]
No regression expected.
---- Original report ----
The m_iconCacheDir variable is used unchecked throughout sni-qt. This may result in deletion of home directory.
This was found by an apparmor "DENIED" while running a sandboxed application (apparmor error data: operation="unlink" name="/
Lets assume we /tmp writes blocked and we have HOME/.* writes blocked.
1. statusnotifieri
[...]
StatusNotifierI
: m_isAvailable(
{
QString tempSubDir = QString(
m_iconCacheDir = FsUtils:
[...]
2. fsutils.cpp: Returns an empty QString if generation of file system objects failed.
QString generateTempDir
{
QDir dir = QDir::temp();
if (!dir.mkpath(".")) {
return QString();
}
QString tmpl = QString(
QByteArray ba = QFile::
const char* name = mkdtemp(ba.data());
if (!name) {
return QString();
}
return QFile::
}
3. statusnotifieri
[...]
m_iconCacheDir = FsUtils:
SNI_
m_iconCache = new IconCache(
[...]
4. iconcache.cpp: IconCache will be created with an empty QString (or another invalid location). If directory creation fails there is an error message printed, but the error stays unchecked.
IconCache:
: QObject(parent)
, m_themePath(baseDir + "/icons")
{
QDir dir(baseDir);
bool ok = dir.mkdir("icons");
if (!ok) {
m_themePath = QString();
return;
}
}
5. statusnotifieri
StatusNotifier
{
SNI_DEBUG;
FsUtils:
}
Changed in sni-qt: | |
status: | New → In Progress |
importance: | Undecided → Critical |
assignee: | nobody → Aurélien Gâteau (agateau) |
description: | updated |
security vulnerability: | yes → no |
visibility: | private → public |
summary: |
- Unsafe m_iconCacheDir handling may result in deletion of home directory + Unsafe m_iconCacheDir handling may result in deletion of some files in + home directory |
Changed in sni-qt (Ubuntu Oneiric): | |
importance: | Undecided → Critical |
Changed in sni-qt (Ubuntu): | |
importance: | Undecided → Critical |
There was a mistake in the assumptions. Please lets assume we have :
* /tmp writes blocked
* HOME/icons/ writes blocked
* HOME/.* writes blocked