On Sa, 16.01.21 13:56, Michael Schwendt (mschwendt@xxxxxxxxx) wrote: > Noticed that when setting Claws Mail to become a startup app in F33 > GNOME Shell, it doesn't create its /tmp/claws-mail-$UID directory. Regardless of the actual issue ran into: taking a predictable name like that in /tmp/ is a DoS vulnerability. /tmp/ is a shared namespace, any local program can take any name in there, and hence block you out from starting Claws mail — simply by creating a file or directory by that name there under their own ownership. Most likely you want to use $XDG_RUNTIME_DIR instead, which is private to your user, and not shared with other users. Use glib's g_get_user_runtime_dir() as a wrapper for accessing that variable. Lennart -- Lennart Poettering, Berlin _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
