Skip to content

Add doc on Unix temporary file security practice #70585

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
agocke merged 6 commits into from
Jun 14, 2022
Merged

Add doc on Unix temporary file security practice #70585

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ef07497
Add doc on Unix temporary file security practice
agocke Jun 10, 2022
ef25c1a
Update unix-tmp.md
agocke Jun 10, 2022
d8555f2
Update unix-tmp.md
agocke Jun 10, 2022
5ff7105
Add example permissions encoding
agocke Jun 10, 2022
045841b
Update docs/design/security/unix-tmp.md
agocke Jun 14, 2022
b2a9a8e
Update unix-tmp.md
agocke Jun 14, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add example permissions encoding
  • Loading branch information
@agocke
agocke committed Jun 10, 2022
commit 5ff7105c105505fceb84f94fd570118938d25dce
12 changes: 6 additions & 6 deletions docs/design/security/unix-tmp.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,10 @@ Most notably, the Windows model for temporary files is that the operating system
Moreover, all Windows users, including the service and system users, have designated user folders, including temporary folders.

The Unix model is very different. The temp directory, assuming there is one, is often a global folder (except on MacOS).
If possible, prefer a library function like `GetTempPath()` to find the folder. Othewrise,
If possible, prefer a library function like `GetTempPath()` to find the folder. Otherwise,
the `TMPDIR` environment variable is used to store the location of this folder. This variable is
widely used and supported, but it is not mandatory for all Unix implementations. It should be the preferred
mechanism for finding the Unix temporary folder, if a library method is not available. It will commonly
mechanism for finding the Unix temporary folder if a library method is not available. It will commonly
point to either the `/tmp` or `/var/tmp` folder. These folders are not used for MacOS, so it is not recommended
to use them directly.

Expand All @@ -24,8 +24,8 @@ considered. In general, the best use of the temp directory is for programs which

In these cases, the process can create a file or files with
1. A pseudorandom name, unlikely to cause collisions
1. Permissions which restrict all access to owner-only
1. Permissions which restrict all access to owner-only, i.e. 700

Any other use needs to be carefully audited, particularly if the temporary file is intended for use across
multiple processes. Some considerations:

Expand All @@ -36,10 +36,10 @@ multiple processes. Some considerations:
creating a denial of service.
- When creating files, consider likelihood of file name collision and performance impact of attempting
Copy link
Member

@tmds tmds Jun 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It can be simplest to create a single folder and do everything else below that.
That folder could even become Path.GetTempPath.

if (Path.GetTempPath() == "/tmp/")
{
    string tmpDir = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"));
    Directory.CreateDirectory(tmpDir, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute);
    Environment.SetEnvironmentVariable("TMPDIR", tmpDir + "/");
}

Copy link
Member

@danmoseley danmoseley Jun 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any value in using a cryptographically secure name here? Guid is not (or at least not enough). It can use GetRandomFileName()

Copy link
Member

@danmoseley danmoseley Jun 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would only make a difference if the attacker has permission to open files in the temp directory but not to enumerate them.

Copy link
Member Author

@agocke agocke Jun 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a question of the app's threat model and can't be answered generally.

to create new names, if supported.

If any of the above conflict with the feature requirements, consider instead writing temporary files to a
location in the user home folder. Some considerations for this model:

- There is no automatic cleanup in user folders. Files will remain permanently or require cleanup by the app
- Some environments do not have user home folders (e.g., systemd). Consider providing an environment variable
Copy link
Member

@tmds tmds Jun 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

systemd has a PrivateTmp feature.

Copy link
Member

@tmds tmds Jun 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe also worth mentioning:
XDG defines XDG_RUNTIME_DIR which is a user-private tmpfs to store runtime files. See https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html.

Copy link
Member

@danmoseley danmoseley Jun 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some interesting requirements there, including that files not survive reboot. It might be worth specifying here that we should not expect our temp files to survive reboot, but we should not expect them to be cleaned up by reboot either.

to override the location of the temporary folder, and provide user documentation for this variable.