Skip to content

fix(native-protocol): add O_NOFOLLOW to lock file creation #294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
deepin-ci-robot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(native-protocol): add O_NOFOLLOW to lock file creation #294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions debian/changelog
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
pipewire (1.6.4-1deepin30) unstable; urgency=medium

* Add O_NOFOLLOW to native protocol lock file creation to prevent symlink attacks

-- deepin-ci-robot <packages@deepin.org> Thu, 05 Nov 2026 21:11:29 +0800

pipewire (1.6.4-1deepin29) unstable; urgency=medium

* Integrate backport PRs #132-#163 and #286 (32 PRs, #139 excluded as
Expand Down
32 changes: 32 additions & 0 deletions debian/patches/fix-native-protocol-add-o-nofollow-to-lock-file-creation.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
From 95ef466b9bd7d46eeb4690eb89cfa87885f6855f Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Fri, 24 Apr 2026 14:12:09 +0200
Subject: [PATCH] security: add O_NOFOLLOW to native protocol lock file
creation

File and Resource Handling: Medium

The lock_socket() function opens the lock file without O_NOFOLLOW. If an
attacker places a symlink at the lock file path, open() follows it and
creates or truncates a file at the symlink target with the caller's
privileges. While the lock path is typically in a user-owned runtime
directory, adding O_NOFOLLOW is a low-cost defense-in-depth measure that
prevents symlink attacks in case the directory permissions are
misconfigured or the path is influenced by untrusted input.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

diff --git a/src/modules/module-protocol-native.c b/src/modules/module-protocol-native.c
index c393316e1..c2401fe37 100644
--- a/src/modules/module-protocol-native.c
+++ b/src/modules/module-protocol-native.c
@@ -776,7 +776,7 @@ static int lock_socket(struct server *s)

snprintf(s->lock_addr, sizeof(s->lock_addr), "%s%s", s->addr.sun_path, LOCK_SUFFIX);

- s->fd_lock = open(s->lock_addr, O_CREAT | O_CLOEXEC,
+ s->fd_lock = open(s->lock_addr, O_CREAT | O_CLOEXEC | O_NOFOLLOW,
(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP));

if (s->fd_lock < 0) {

1 change: 1 addition & 0 deletions debian/patches/series
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,3 +127,4 @@ fix-netjack2-validate-opus-encoded-length.patch
fix-security-missing-null-checks-pw-split-strv.patch
fix-netjack2-use-peer-params-name-and-follower-name.patch
fix-protocol-pulse-add-per-client-operation-count-limit.patch
fix-native-protocol-add-o-nofollow-to-lock-file-creation.patch
Loading