GNU bug report logs - #33366
emacsclient to not follow symlinks to sockets

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 33366 in the body.
You can then email your comments to 33366 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #1 received at quiet <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: quiet <at> debbugs.gnu.org
Subject: emacsclient to not follow symlinks to sockets
Date: Tue, 13 Nov 2018 13:20:21 -0500

Package: emacs
Version: 26.2
Severity: minor
Tags: security

In http://lists.gnu.org/r/emacs-devel/2018-11/msg00051.html some concern
was expressed about potential security implications from emacsclient
following symlinks to incorrect sockets.

Message #4 received at 33366 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: 33366 <at> debbugs.gnu.org
Subject: Re: emacsclient to not follow symlinks to sockets
Date: Mon, 3 Dec 2018 00:09:15 -0800

[Message part 1 (text/plain, inline)]

After looking into this, I don't see any good solution on older systems where 
Emacs sockets are put under /tmp, particularly on ancient systems where /tmp is 
not sticky. There are too many ways to fool Emacs with symlinks, and none of the 
workarounds avoid all races. I did install the attached patch to fix a race that 
is reasonably easy to fix, by checking the socket's UID after connecting to it 
as well as before connecting to it.

On more-modern desktops where Emacs sockets live under XDG_RUNTIME_DIR (see 
Bug#33367, now fixed), the security issues of symlinks-to-sockets should go away 
unless the user explicitly specifies a socket. This may be the best we can do.

[0001-emacsclient-fix-symlink-socket-race.patch (text/x-patch, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.