uutils/coreutils

mkfifo TOCTOU race via path-based chmod

Open

#10.020 aperta il 3 gen 2026

Vedi su GitHub
 (0 commenti) (0 reazioni) (0 assegnatari)Rust (1852 fork)batch import
U - mkfifogood first issuereported-canonical

Metriche repository

Star
 (23.246 star)
Metriche merge PR
 (Merge medio 9g 14h) (216 PR mergiate in 30 g)

Descrizione

Component

mkfifo

Description

mkfifo creates a FIFO and then unconditionally performs a path-based chmod via std::fs::set_permissions.

Between these operations, an attacker with write access to the containing directory can replace the FIFO with a symlink.

Additionally, for the default case (no -m flag), the chmod is redundant as the kernel already applies umask during creation.

Test / Reproduction Steps

# Terminal 1 (attacker, racing the chmod):
while true; do
  rm -f /tmp/fifo; ln -s /etc/shadow /tmp/fifo
done

# Terminal 2 (victim with privileges):
while true; do
  rm -f /tmp/fifo; mkfifo -m 0666 /tmp/fifo
done

# Check if /etc/shadow permissions changed

Guida contributor