]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
tools/power/x86/intel-speed-select: Harden daemon pidfile open
authorAli Ahmet MEMIS <dev@unknownbbqr.xyz>
Sun, 26 Apr 2026 15:09:28 +0000 (08:09 -0700)
committerSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Tue, 2 Jun 2026 17:39:45 +0000 (10:39 -0700)
commit607af438e6430893a822964c841a1994b33acccc
tree9401f9875d5bc2aaf76fa95798a2d9a319c71f80
parenta167ae8eace52dd6c80438b77d92450fe12cd4be
tools/power/x86/intel-speed-select: Harden daemon pidfile open

Avoid symlink-based pidfile clobbering by opening the pidfile with
O_NOFOLLOW and validating it with fstat() before locking/writing.

The daemon currently uses a fixed pidfile path under /tmp. A local
unprivileged user can pre-create a symlink at that path and cause a
root-run daemon instance to write into an attacker-chosen file.

Fixes: 7fd786dfbd2c ("tools/power/x86/intel-speed-select: OOB daemon mode")
Signed-off-by: Ali Ahmet MEMIS <dev@unknownbbqr.xyz>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: stable@kernel.org
tools/power/x86/intel-speed-select/isst-daemon.c