GNU bug report logs - #51327
28.0.60; emacsclient warns about XDG_RUNTIME_DIR when starting daemon on-demand

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: emacs; Reported by: Jim Porter <jporterbugs@HIDDEN>; Keywords: security; dated Fri, 22 Oct 2021 04:59:02 UTC; Maintainer for emacs is bug-gnu-emacs@HIDDEN.

Message received at 51327 <at> debbugs.gnu.org:


Received: (at 51327) by debbugs.gnu.org; 5 Nov 2021 19:02:57 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Nov 05 15:02:57 2021
Received: from localhost ([127.0.0.1]:47246 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mj4UL-0002Y0-8s
	for submit <at> debbugs.gnu.org; Fri, 05 Nov 2021 15:02:57 -0400
Received: from woodpecker.gentoo.org ([140.211.166.183]:37654
 helo=smtp.gentoo.org) by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ulm@HIDDEN>) id 1mj4UI-0002Xm-SS
 for 51327 <at> debbugs.gnu.org; Fri, 05 Nov 2021 15:02:55 -0400
From: Ulrich Mueller <ulm@HIDDEN>
To: Jim Porter <jporterbugs@HIDDEN>
Subject: Re: bug#51327: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR
 when starting daemon on demand
In-Reply-To: <f13fb4b7-0299-db20-e80c-9c14be4ba466@HIDDEN> (Jim Porter's
 message of "Fri, 5 Nov 2021 11:38:48 -0700")
References: <ba5ee273-9d0f-7baf-ef2e-d0b005f29ed0@HIDDEN>
 <uczneyjin@HIDDEN>
 <238ece9e-df13-a604-ba3a-36b346857423@HIDDEN>
 <uwnlmwk9u@HIDDEN>
 <f13fb4b7-0299-db20-e80c-9c14be4ba466@HIDDEN>
Date: Fri, 05 Nov 2021 20:02:43 +0100
Message-ID: <umtmiwhm4@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 51327
Cc: Ulrich Mueller <ulm@HIDDEN>, 51327 <at> debbugs.gnu.org,
 Paul Eggert <eggert@HIDDEN>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

>>>>> On Fri, 05 Nov 2021, Jim Porter wrote:

> (Cc'ing Paul Eggert, who can probably answer more confidently than me.)
> On 11/5/2021 11:05 AM, Ulrich Mueller wrote:
>> Can someone please explain to me how an exploit on the _client_ side
>> would look like?

>> When starting the server, I can believe that there may be some
>> surface for a symlink attack. But once the daemon is running? What is
>> the security issue for the client checking TMPDIR?

> I'm not an expert on this kind of attack, but my understanding is that
> it could go something like this:

>  1. Attacker runs `evil-daemon' which puts its socket in /tmp/evil
>  2. Attacker runs `ln -s /tmp/evil /tmp/emacs1000/server'

Right, and IIUC this must be carefully timed to exploit some race
condition between permission checking and creating the socket. I am not
an expert on this either.

>  3. User runs `emacsclient --alternate-editor=""'
>  4. emacsclient doesn't see a socket in XDG_RUNTIME_DIR, checks TMPDIR
>  5. emacsclient connects to evil-daemon

Note that after locating the socket, emacsclient will double check for
sane permissions. That is, correct user id and _no_ write permission for
either group or others. That's why I think that there's little attack
surface on the client side, once the socket has been created.

> The evil-daemon probably can't get access to the user's files, but
> might be able to trick a user into entering some secret. I'll let
> others chime in too though, since like I said, I'm not an expert.

> If I'm wrong and this isn't an a problem, then I agree that all we
> need to do here is silence the warning.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#51327; Package emacs. Full text available.

Message received at 51327 <at> debbugs.gnu.org:


Received: (at 51327) by debbugs.gnu.org; 5 Nov 2021 18:38:56 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Nov 05 14:38:56 2021
Received: from localhost ([127.0.0.1]:47213 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mj476-0008Eg-Hq
	for submit <at> debbugs.gnu.org; Fri, 05 Nov 2021 14:38:56 -0400
Received: from mail-pj1-f45.google.com ([209.85.216.45]:40553)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <jporterbugs@HIDDEN>) id 1mj474-0008ES-Jq
 for 51327 <at> debbugs.gnu.org; Fri, 05 Nov 2021 14:38:54 -0400
Received: by mail-pj1-f45.google.com with SMTP id
 n36-20020a17090a5aa700b0019fa884ab85so3934295pji.5
 for <51327 <at> debbugs.gnu.org>; Fri, 05 Nov 2021 11:38:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=subject:to:cc:references:from:message-id:date:mime-version
 :in-reply-to:content-language:content-transfer-encoding;
 bh=MiGhWH2j2cw0qmwxsbOuzZgpDIVPmATTk7VWONWWAl8=;
 b=dWH8QyARvmI1e3A9KnClEt85wfvsoRQRHojFr8Z28CQpwPtWY7va2e/+pU5J22IoHp
 hPPmx4Iev4To1UdsB5wyFySeWsQiH0+jofVVU8KIVe/oMGOapJEwPllPE4e7GSJ+FiLQ
 BJjXTIJX6/Oa7x4U0Na4eAwBFPmIcMZaZJogzuX9RwHkukWX5m5YJZ2UYN2R2oMlYWgT
 nL4LjSqOaaCo+Uz2WpEkkcmXSSOoJ7Adf0oUP6Wa5L0aV79jvBkdxhTdbN4pGXe3k+gY
 4CKx2/bx5X+Aln+NEm1vkT3PKAhuAQ7jCiD+yC+/ndIEzW1DDjo8eivSiQ4zbkLt9kcN
 NYiw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=x-gm-message-state:subject:to:cc:references:from:message-id:date
 :mime-version:in-reply-to:content-language:content-transfer-encoding;
 bh=MiGhWH2j2cw0qmwxsbOuzZgpDIVPmATTk7VWONWWAl8=;
 b=WiDD2ONKW+vimcRCQpRWYd7Nud/RQGkOdsgzcetIAomM7HUt3ouCnIuzKJKNUVbnNY
 LD/eSJVOAxDCUYDXj8CM23nJxWj1kvWI4tRHaOXpgJVWTSjBrR2EnA1Wtn8rLdcrUr3w
 zJoaSpIfF1UC7keBnb9sPBUC5XzVa/ZDvzScXdjzoHZEKDjSo7+1J9GAOKwLXIZCvkuL
 wEoqqIbJamiFlJm0TlUlrRVSLFap8VSPq845ccjxXxEyXFkVJ2ihqsX/3ekSw3+dxmDO
 oh2n5XfQJ/VdrGrHtdYERTooLzzq0pigH1LUa2EtBnRaOkqhix7QiddpwWFFodd0VKuM
 lX/w==
X-Gm-Message-State: AOAM533/RR1Z6dRPJCZ0VOCaOwFv82ZVvcAQLXWbXm/Bjt4tY3ZcAnWT
 CA62bAnaZ37hpfGmcA8w+jM=
X-Google-Smtp-Source: ABdhPJxSJwPrWaUmRcOh1IHisZNTmnoG/d8FsQ9RVjOkGX0bUh81GWnUfkOMI31KRwkm9ahl1ctdUw==
X-Received: by 2002:a17:90a:4586:: with SMTP id
 v6mr32394936pjg.43.1636137528658; 
 Fri, 05 Nov 2021 11:38:48 -0700 (PDT)
Received: from [192.168.1.2] (cpe-76-168-148-233.socal.res.rr.com.
 [76.168.148.233])
 by smtp.googlemail.com with ESMTPSA id e6sm6444806pgf.59.2021.11.05.11.38.47
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
 Fri, 05 Nov 2021 11:38:48 -0700 (PDT)
Subject: Re: bug#51327: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR when
 starting daemon on demand
To: Ulrich Mueller <ulm@HIDDEN>
References: <ba5ee273-9d0f-7baf-ef2e-d0b005f29ed0@HIDDEN>
 <uczneyjin@HIDDEN> <238ece9e-df13-a604-ba3a-36b346857423@HIDDEN>
 <uwnlmwk9u@HIDDEN>
From: Jim Porter <jporterbugs@HIDDEN>
Message-ID: <f13fb4b7-0299-db20-e80c-9c14be4ba466@HIDDEN>
Date: Fri, 5 Nov 2021 11:38:48 -0700
MIME-Version: 1.0
In-Reply-To: <uwnlmwk9u@HIDDEN>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-Spam-Score: -0.0 (/)
X-Debbugs-Envelope-To: 51327
Cc: 51327 <at> debbugs.gnu.org, Paul Eggert <eggert@HIDDEN>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

(Cc'ing Paul Eggert, who can probably answer more confidently than me.)

On 11/5/2021 11:05 AM, Ulrich Mueller wrote:
> Can someone please explain to me how an exploit on the _client_ side
> would look like?
> 
> When starting the server, I can believe that there may be some surface
> for a symlink attack. But once the daemon is running? What is the
> security issue for the client checking TMPDIR?

I'm not an expert on this kind of attack, but my understanding is that 
it could go something like this:

  1. Attacker runs `evil-daemon' which puts its socket in /tmp/evil
  2. Attacker runs `ln -s /tmp/evil /tmp/emacs1000/server'
  3. User runs `emacsclient --alternate-editor=""'
  4. emacsclient doesn't see a socket in XDG_RUNTIME_DIR, checks TMPDIR
  5. emacsclient connects to evil-daemon

The evil-daemon probably can't get access to the user's files, but might 
be able to trick a user into entering some secret. I'll let others chime 
in too though, since like I said, I'm not an expert.

If I'm wrong and this isn't an a problem, then I agree that all we need 
to do here is silence the warning.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#51327; Package emacs. Full text available.

Message received at 51327 <at> debbugs.gnu.org:


Received: (at 51327) by debbugs.gnu.org; 5 Nov 2021 18:05:30 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Nov 05 14:05:30 2021
Received: from localhost ([127.0.0.1]:47128 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mj3aj-0007OT-Sf
	for submit <at> debbugs.gnu.org; Fri, 05 Nov 2021 14:05:30 -0400
Received: from woodpecker.gentoo.org ([140.211.166.183]:49864
 helo=smtp.gentoo.org) by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ulm@HIDDEN>) id 1mj3ai-0007O1-7T
 for 51327 <at> debbugs.gnu.org; Fri, 05 Nov 2021 14:05:28 -0400
From: Ulrich Mueller <ulm@HIDDEN>
To: Jim Porter <jporterbugs@HIDDEN>
Subject: Re: bug#51327: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR
 when starting daemon on demand
In-Reply-To: <238ece9e-df13-a604-ba3a-36b346857423@HIDDEN> (Jim Porter's
 message of "Fri, 5 Nov 2021 10:54:29 -0700")
References: <ba5ee273-9d0f-7baf-ef2e-d0b005f29ed0@HIDDEN>
 <uczneyjin@HIDDEN>
 <238ece9e-df13-a604-ba3a-36b346857423@HIDDEN>
Date: Fri, 05 Nov 2021 19:05:17 +0100
Message-ID: <uwnlmwk9u@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 51327
Cc: 51327 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

Can someone please explain to me how an exploit on the _client_ side
would look like?

When starting the server, I can believe that there may be some surface
for a symlink attack. But once the daemon is running? What is the
security issue for the client checking TMPDIR?




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#51327; Package emacs. Full text available.

Message received at 51327 <at> debbugs.gnu.org:


Received: (at 51327) by debbugs.gnu.org; 5 Nov 2021 17:54:40 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Nov 05 13:54:40 2021
Received: from localhost ([127.0.0.1]:47109 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mj3QF-00077H-WF
	for submit <at> debbugs.gnu.org; Fri, 05 Nov 2021 13:54:40 -0400
Received: from mail-pj1-f47.google.com ([209.85.216.47]:52868)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <jporterbugs@HIDDEN>) id 1mj3QA-00076z-V1
 for 51327 <at> debbugs.gnu.org; Fri, 05 Nov 2021 13:54:38 -0400
Received: by mail-pj1-f47.google.com with SMTP id h24so2496692pjq.2
 for <51327 <at> debbugs.gnu.org>; Fri, 05 Nov 2021 10:54:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=subject:to:references:from:message-id:date:mime-version:in-reply-to
 :content-language:content-transfer-encoding;
 bh=qsjqsJuAG96HVuKLzky2sgHjBn6TzFCbNf8oEk+Exv0=;
 b=qX5EAf5MfMwkzKO56oCXJk8ZkHQj+L2q6xLPAsltnxN2MhKdFpXe2RvLDMrdrMgbOT
 oEHnVzzL1znzb0E1XETa9k60bT6kBSoAuE28YA/Un1ZVJA93KqwcUnDw1UvZvLeO8aLQ
 oel1oseLsar42py7StqDT8YomcKLgg6KaWW1t8nUDl2go5MPu1ev2yI0NMcw/4bXZQRI
 /EEnrwz7FjksgimCNDcDT0WSj/GR38UfKmS9bAVc1VvMuLMnScSfFTS/raqbbqzz56CL
 KhsBnnYBiphfgMjXWSgl5FejsKYfWb9f3+fSyDdFG/gXsvDqvpfCJGPaiYRSNg/RhXNf
 EKiQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=x-gm-message-state:subject:to:references:from:message-id:date
 :mime-version:in-reply-to:content-language:content-transfer-encoding;
 bh=qsjqsJuAG96HVuKLzky2sgHjBn6TzFCbNf8oEk+Exv0=;
 b=3U2JcCA+87Qv51rN56VXMuvUWbuAdQmfTQLzZ9gmIWtJHOsdxajRr1GN89uW5g0bVd
 NLUS7dHjQlJtZrQQ6xsCnKpfzOOp+hf27rmChE/i7Z420r4HfxGKCL68R5Zzc7C6xLv9
 wQ9YCHPRu++eIii+aD2eT3925ARWIFOUqb1yaBXtbVnN6jcMDhQ32iu8MwS2IJWe/0Lh
 T8RDwQV+DgEBNV5WeiimZ7Dt6BbWGmkQVm8PSlH4ZgZVKCsNVN52ofXfzn7nTMPn1uJI
 sbwCRdW53C4a9bN2P/c/+It9GWL9oEjaGCWvcu2kYSfY+QOrMiZCYpsEY1CQ+3s+b/Ou
 7I7g==
X-Gm-Message-State: AOAM530s+oC9FzOQr8s155SYtD19oEj1F77Tc5tm2MTew8ChAtwbBtmB
 dMns+fS5PN02MpsT/5jS0NV5GeRaxbo=
X-Google-Smtp-Source: ABdhPJz4EbC+qm9JtNL4qPckRdBYp/683PPIcIaVJ0GM6+r2lPuBtFktQuO09d2GwAfgnqNyd8CsyQ==
X-Received: by 2002:a17:90a:8912:: with SMTP id
 u18mr31223649pjn.69.1636134869067; 
 Fri, 05 Nov 2021 10:54:29 -0700 (PDT)
Received: from [192.168.1.2] (cpe-76-168-148-233.socal.res.rr.com.
 [76.168.148.233]) by smtp.googlemail.com with ESMTPSA id
 x193sm6526110pfd.160.2021.11.05.10.54.28
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
 Fri, 05 Nov 2021 10:54:28 -0700 (PDT)
Subject: Re: bug#51327: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR when
 starting daemon on demand
To: Ulrich Mueller <ulm@HIDDEN>, 51327 <at> debbugs.gnu.org
References: <ba5ee273-9d0f-7baf-ef2e-d0b005f29ed0@HIDDEN>
 <uczneyjin@HIDDEN>
From: Jim Porter <jporterbugs@HIDDEN>
Message-ID: <238ece9e-df13-a604-ba3a-36b346857423@HIDDEN>
Date: Fri, 5 Nov 2021 10:54:29 -0700
MIME-Version: 1.0
In-Reply-To: <uczneyjin@HIDDEN>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-Spam-Score: -0.0 (/)
X-Debbugs-Envelope-To: 51327
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

On 11/5/2021 3:38 AM, Ulrich Mueller wrote:
> If I understand this report correctly, the problem is just the spurious
> warning about XDG_RUNTIME_DIR?
> 
> Instead of changing the functionality (which breaks other use cases, see
> my message to emacs-devel), wouldn't it make more sense to just suppress
> the warning if the variable is set? As in attached patch?

It's not just a spurious warning; the warning is telling the user about 
a real problem, though the wording is a bit confusing for this 
particular case. If a user calls `emacsclient --alternate-editor=""' 
with XDG_RUNTIME_DIR set and no Emacs server running, emacsclient will 
check in both XDG_RUNTIME_DIR and TMPDIR to find the server socket 
before giving up and starting the daemon.

Since XDG_RUNTIME_DIR exists (at least in part) to prevent symlink 
attacks, Emacs should try to avoid checking TMPDIR in order to avoid 
this vulnerability. Emacs 27 is secure in this regard, since it *never* 
checks TMPDIR if XDG_RUNTIME_DIR is set. However, that behavior caused 
the problems described in bug#33847. The patch I posted is a compromise 
that restores the secure behavior for users who set the alternate editor 
and want to start the Emacs daemon on demand (it's not perfect though; 
see my reply in emacs-devel).




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#51327; Package emacs. Full text available.

Message received at 51327 <at> debbugs.gnu.org:


Received: (at 51327) by debbugs.gnu.org; 5 Nov 2021 10:38:54 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Nov 05 06:38:54 2021
Received: from localhost ([127.0.0.1]:44947 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1miwcY-000840-1K
	for submit <at> debbugs.gnu.org; Fri, 05 Nov 2021 06:38:54 -0400
Received: from woodpecker.gentoo.org ([140.211.166.183]:37806
 helo=smtp.gentoo.org) by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ulm@HIDDEN>) id 1miwcV-00083i-Kb
 for 51327 <at> debbugs.gnu.org; Fri, 05 Nov 2021 06:38:52 -0400
From: Ulrich Mueller <ulm@HIDDEN>
To: 51327 <at> debbugs.gnu.org
Subject: Re: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR when starting
 daemon on demand
Date: Fri, 05 Nov 2021 11:38:40 +0100
Message-ID: <uczneyjin@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=-=-="
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 51327
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

--=-=-=
Content-Type: text/plain

If I understand this report correctly, the problem is just the spurious
warning about XDG_RUNTIME_DIR?

Instead of changing the functionality (which breaks other use cases, see
my message to emacs-devel), wouldn't it make more sense to just suppress
the warning if the variable is set? As in attached patch?

--=-=-=
Content-Type: text/plain
Content-Disposition: attachment;
 filename=0001-Suppress-a-spurious-warning-in-emacsclient.patch

From 8b13b4ce6b5c5998ea8dc6db0c1021f2beba41aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulrich=20M=C3=BCller?= <ulm@HIDDEN>
Date: Fri, 5 Nov 2021 11:30:28 +0100
Subject: [PATCH] Suppress a spurious warning in emacsclient

* lib-src/emacsclient.c (set_local_socket): Suppress warning about
unset XDG_RUNTIME_DIR if the variable is actually set.
(Bug#51327)
---
 lib-src/emacsclient.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib-src/emacsclient.c b/lib-src/emacsclient.c
index 0e800dd7e8..d812ae6bc8 100644
--- a/lib-src/emacsclient.c
+++ b/lib-src/emacsclient.c
@@ -1447,6 +1447,7 @@ set_local_socket (char const *server_name)
   int tmpdirlen = -1;
   int socknamelen = -1;
   uid_t uid = geteuid ();
+  char const *xdg_runtime_dir = NULL;
   bool tmpdir_used = false;
   int s = cloexec_socket (AF_UNIX, SOCK_STREAM, 0);
   if (s < 0)
@@ -1468,7 +1469,7 @@ set_local_socket (char const *server_name)
     {
       /* socket_name is a file name component.  */
       sock_status = ENOENT;
-      char const *xdg_runtime_dir = egetenv ("XDG_RUNTIME_DIR");
+      xdg_runtime_dir = egetenv ("XDG_RUNTIME_DIR");
       if (xdg_runtime_dir)
 	{
 	  socknamelen = snprintf (sockname, socknamesize, "%s/emacs/%s",
@@ -1559,7 +1560,8 @@ set_local_socket (char const *server_name)
 	  int sockdirnamelen = snprintf (sockdirname, sizeof sockdirname,
 					 "/run/user/%"PRIuMAX, id);
 	  if (0 <= sockdirnamelen && sockdirnamelen < sizeof sockdirname
-	      && faccessat (AT_FDCWD, sockdirname, X_OK, AT_EACCESS) == 0)
+	      && faccessat (AT_FDCWD, sockdirname, X_OK, AT_EACCESS) == 0
+	      && !xdg_runtime_dir)
 	    message
 	      (true,
 	       ("%s: Should XDG_RUNTIME_DIR='%s' be in the environment?\n"
-- 
2.33.1


--=-=-=--




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#51327; Package emacs. Full text available.

Message received at 51327 <at> debbugs.gnu.org:


Received: (at 51327) by debbugs.gnu.org; 30 Oct 2021 22:33:22 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Oct 30 18:33:22 2021
Received: from localhost ([127.0.0.1]:58582 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mgwug-0004NK-CV
	for submit <at> debbugs.gnu.org; Sat, 30 Oct 2021 18:33:22 -0400
Received: from zimbra.cs.ucla.edu ([131.179.128.68]:36470)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <eggert@HIDDEN>) id 1mgwud-0004N5-JO
 for 51327 <at> debbugs.gnu.org; Sat, 30 Oct 2021 18:33:20 -0400
Received: from localhost (localhost [127.0.0.1])
 by zimbra.cs.ucla.edu (Postfix) with ESMTP id 4918A1600EB;
 Sat, 30 Oct 2021 15:33:13 -0700 (PDT)
Received: from zimbra.cs.ucla.edu ([127.0.0.1])
 by localhost (zimbra.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10032)
 with ESMTP id jjdj3vYFbjCM; Sat, 30 Oct 2021 15:33:12 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
 by zimbra.cs.ucla.edu (Postfix) with ESMTP id A1B8F1600FC;
 Sat, 30 Oct 2021 15:33:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at zimbra.cs.ucla.edu
Received: from zimbra.cs.ucla.edu ([127.0.0.1])
 by localhost (zimbra.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10026)
 with ESMTP id Oqpsl-BP-XtM; Sat, 30 Oct 2021 15:33:12 -0700 (PDT)
Received: from [192.168.1.9] (cpe-172-91-119-151.socal.res.rr.com
 [172.91.119.151])
 by zimbra.cs.ucla.edu (Postfix) with ESMTPSA id 6763B1600EB;
 Sat, 30 Oct 2021 15:33:12 -0700 (PDT)
Message-ID: <b6140cd0-b692-0be9-70c2-64e751381ae6@HIDDEN>
Date: Sat, 30 Oct 2021 15:33:11 -0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.1.2
Subject: Re: bug#51327: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR when
 starting daemon on-demand
Content-Language: en-US
To: Jim Porter <jporterbugs@HIDDEN>
References: <ba5ee273-9d0f-7baf-ef2e-d0b005f29ed0@HIDDEN>
 <53706fa9-1458-fb5c-bd31-15ab555b59e9@HIDDEN>
From: Paul Eggert <eggert@HIDDEN>
Organization: UCLA Computer Science Department
In-Reply-To: <53706fa9-1458-fb5c-bd31-15ab555b59e9@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Spam-Score: -2.4 (--)
X-Debbugs-Envelope-To: 51327
Cc: 51327 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -3.4 (---)

Thanks, this patch looks good to me. You're right that the current 
approach is insecure, and your patch should make it somewhat less insecure.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#51327; Package emacs. Full text available.

Message received at 51327 <at> debbugs.gnu.org:


Received: (at 51327) by debbugs.gnu.org; 30 Oct 2021 19:37:13 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Oct 30 15:37:12 2021
Received: from localhost ([127.0.0.1]:58485 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mguAC-0008OU-JA
	for submit <at> debbugs.gnu.org; Sat, 30 Oct 2021 15:37:12 -0400
Received: from mail-pj1-f43.google.com ([209.85.216.43]:42703)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <jporterbugs@HIDDEN>) id 1mguAA-0008OI-Pd
 for 51327 <at> debbugs.gnu.org; Sat, 30 Oct 2021 15:37:11 -0400
Received: by mail-pj1-f43.google.com with SMTP id
 nn3-20020a17090b38c300b001a03bb6c4ebso9745835pjb.1
 for <51327 <at> debbugs.gnu.org>; Sat, 30 Oct 2021 12:37:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=subject:from:to:cc:references:message-id:date:mime-version
 :in-reply-to:content-language;
 bh=eokKXPErDDuO3HWssqTTmpUCjEMOQ0t7scrKT861+FM=;
 b=MKFM5CpMfMzjNU9Rk49uX0Q6htO1L0/WD6b3rRYwq/ddS1v8spZmvcUGXdA5G5o/iZ
 BjLAoyMPEKqHJJAyIa2A6v9w3egfXuL/MUUFgtZBYKvFXdfYGX4FQt+6Ne6wvGbTpOZs
 ieNeIBvq72/S4lQjWB5kjVP74QLKOriTGa4VWC0yrhP3MIIXa/gVY/1vaMTfV6flU+LZ
 OgycYyVGSiu1PaqGeQBA55muV9xd2k5Km1VeetGupbjoFLCJqIhWm7OGOib2hxvvDwsj
 YcHvck/7XDGrKbM7NXNog25Ksi5V/o4iBZIz5tLyylAkpoPXtr9U+BkAZfAUWczimPo2
 G+6A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=x-gm-message-state:subject:from:to:cc:references:message-id:date
 :mime-version:in-reply-to:content-language;
 bh=eokKXPErDDuO3HWssqTTmpUCjEMOQ0t7scrKT861+FM=;
 b=zjW/oHg85xGFj2hDCqV3Wx3OVvNt7EMmZWYWc/SV951MoIOPPIe9VonBU1LewVbo0V
 clnr9v5QwdYtTdDQvOvmeZRpfwHoFcb5AWMwdgNAd9WK4b19Ax/fmuGL7RJt4xAb0t53
 p5HSntoBMbOE5IgAvFUIhL6UbuUI/dAMW3JTfbzBQlxe3q4PWTag395s2sLTc8mzbACZ
 etbuGI3L4I+1A4OUHqZuEkR1auQyGqKIX3/nt4W6NCUVQlXEYmIGS3Qv9H0e1EcsikZL
 AgVU8sOS7uf4b6HUPci/8urSpkvy9KVuuGBN90F1ljG04lTKfBqc7xeHWRaOsaZR0OXN
 QpUQ==
X-Gm-Message-State: AOAM533/Bc9CREgNUDSfv3IkpumPVUZ21qO+bXIi6WB8bCNNEqfqCbRp
 CRTOwD1G/Y66d3hEFJAEETI=
X-Google-Smtp-Source: ABdhPJyI/e8AoTgDvlm292LxfLerIobqInZXnNEjgRxp3IKmNOOofiPqOAh0sZR4ovGdup3gUKJdeg==
X-Received: by 2002:a17:902:b94a:b0:141:8454:d665 with SMTP id
 h10-20020a170902b94a00b001418454d665mr16548780pls.88.1635622624834; 
 Sat, 30 Oct 2021 12:37:04 -0700 (PDT)
Received: from [192.168.1.2] (cpe-76-168-148-233.socal.res.rr.com.
 [76.168.148.233])
 by smtp.googlemail.com with ESMTPSA id m4sm4176913pjs.1.2021.10.30.12.37.02
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
 Sat, 30 Oct 2021 12:37:03 -0700 (PDT)
Subject: Re: bug#51327: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR when
 starting daemon on-demand
From: Jim Porter <jporterbugs@HIDDEN>
To: 51327 <at> debbugs.gnu.org
References: <ba5ee273-9d0f-7baf-ef2e-d0b005f29ed0@HIDDEN>
Message-ID: <53706fa9-1458-fb5c-bd31-15ab555b59e9@HIDDEN>
Date: Sat, 30 Oct 2021 12:37:02 -0700
MIME-Version: 1.0
In-Reply-To: <ba5ee273-9d0f-7baf-ef2e-d0b005f29ed0@HIDDEN>
Content-Type: multipart/mixed; boundary="------------D0A415F2BE8E27FC4474B716"
Content-Language: en-US
X-Spam-Score: -0.0 (/)
X-Debbugs-Envelope-To: 51327
Cc: eggert@HIDDEN
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

This is a multi-part message in MIME format.
--------------D0A415F2BE8E27FC4474B716
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit

On 10/21/2021 9:58 PM, Jim Porter wrote:
> Normally, when running `emacsclient --alternate-editor=""' with no Emacs 
> server running, it will run `emacs --daemon' and then connect to it. In 
> Emacs 28, it will also issue the following warning:
> 
>    Should XDG_RUNTIME_DIR='/run/user/1000' be in the environment?
>    (Be careful: XDG_RUNTIME_DIR is security-related.)
> 
> However, XDG_RUNTIME_DIR *is* set in my environment, so it shouldn't be 
> warning me about it.
> 
> I believe this is due to the fix for bug#33847 (see commit 
> 007744dd0404d6febca88b00c22981cc630fb8c0). That bug asked for 
> emacsclient to look in both XDG_RUNTIME_DIR and TMPDIR to find the 
> server socket, in order to accommodate the case where `emacs --daemon' 
> is started when XDG_RUNTIME_DIR is unset, but *is* set when running 
> `emacsclient'.

Attached is a patch that should fix this by skipping the TMPDIR check 
whenever a) we have an alternate editor and b) XDG_RUNTIME_DIR is set. 
This has the benefit of supporting the use case in bug#33847 as well as 
users who start the Emacs daemon on-demand.

The only flaw I can think of with this method is that it would still be 
technically possible to perform a symlink attack against a user who runs 
`emacs --daemon' explicitly with XDG_RUNTIME_DIR set, and then runs 
`emacsclient' without an alternate editor set. However, this would 
require the attacker to be able to kill the `emacs --daemon' process 
somehow so that emacsclient falls back to looking in TMPDIR. I'm not 
sure that's a realistic attack vector, but I thought I'd mention it for 
completeness.

--------------D0A415F2BE8E27FC4474B716
Content-Type: text/plain; charset=UTF-8;
 name="0001-Prevent-symlink-attacks-in-emacsclient-when-an-alter.patch"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename*0="0001-Prevent-symlink-attacks-in-emacsclient-when-an-alter.pa";
 filename*1="tch"

RnJvbSA2YjhjN2E5ODgxYjc5MjU0YzYxODM1NmE0ZGZhMjU3ODEyYTZmZTVjIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBKaW0gUG9ydGVyIDxqcG9ydGVyYnVnc0BnbWFpbC5j
b20+CkRhdGU6IFNhdCwgMzAgT2N0IDIwMjEgMTI6MjI6MDIgLTA3MDAKU3ViamVjdDogW1BB
VENIXSBQcmV2ZW50IHN5bWxpbmsgYXR0YWNrcyBpbiBlbWFjc2NsaWVudCB3aGVuIGFuIGFs
dGVybmF0ZQogZWRpdG9yIGlzIHNldAoKKiBsaWItc3JjL2VtYWNzY2xpZW50LmMgKHNldF9s
b2NhbF9zb2NrZXQpOiBEb24ndCBsb29rIGluIFRNUERJUiBmb3IgYQpzb2NrZXQgaWYgd2Ug
aGF2ZSBhbiBhbHRlcm5hdGUgZWRpdG9yIGFuZCBYREdfUlVOVElNRV9ESVIgaXMgc2V0CihC
dWcjNTEzMjcpLgotLS0KIGxpYi1zcmMvZW1hY3NjbGllbnQuYyB8IDUgKysrKy0KIDEgZmls
ZSBjaGFuZ2VkLCA0IGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKCmRpZmYgLS1naXQg
YS9saWItc3JjL2VtYWNzY2xpZW50LmMgYi9saWItc3JjL2VtYWNzY2xpZW50LmMKaW5kZXgg
Y2ZmM2NlYzJhNy4uMTMwNTIyNjA1NiAxMDA2NDQKLS0tIGEvbGliLXNyYy9lbWFjc2NsaWVu
dC5jCisrKyBiL2xpYi1zcmMvZW1hY3NjbGllbnQuYwpAQCAtMTQ2Niw3ICsxNDY2LDEwIEBA
IHNldF9sb2NhbF9zb2NrZXQgKGNoYXIgY29uc3QgKnNlcnZlcl9uYW1lKQogCQkJID8gY29u
bmVjdF9zb2NrZXQgKEFUX0ZEQ1dELCBzb2NrbmFtZSwgcywgMCkKIAkJCSA6IEVOQU1FVE9P
TE9ORyk7CiAJfQotICAgICAgaWYgKHNvY2tfc3RhdHVzID09IEVOT0VOVCkKKyAgICAgIC8q
IEZhbGwgYmFjayB0byBjaGVja2luZyBmb3IgYSBzb2NrZXQgaW4gVE1QRElSIHVubGVzcyB3
ZSBoYXZlCisJIGFuIGFsdGVybmF0ZSBlZGl0b3IgYW5kIFhER19SVU5USU1FX0RJUiBpcyBz
ZXQuICBJbiB0aGF0CisJIGNhc2UsIHdlIHdhbnQgdG8gYmFpbCBvdXQgYW5kIHNwYXduIHRo
ZSBhbHRlcm5hdGUgZWRpdG9yLiAqLworICAgICAgaWYgKCEoeGRnX3J1bnRpbWVfZGlyICYm
IGFsdGVybmF0ZV9lZGl0b3IpICYmIHNvY2tfc3RhdHVzID09IEVOT0VOVCkKIAl7CiAJICBj
aGFyIGNvbnN0ICp0bXBkaXIgPSBlZ2V0ZW52ICgiVE1QRElSIik7CiAJICBpZiAodG1wZGly
KQotLSAKMi4yNS4xCgo=
--------------D0A415F2BE8E27FC4474B716--




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#51327; Package emacs. Full text available.
Added tag(s) security. Request was from Stefan Kangas <stefan@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 22 Oct 2021 04:58:09 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Oct 22 00:58:09 2021
Received: from localhost ([127.0.0.1]:59069 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mdmd7-00010z-GJ
	for submit <at> debbugs.gnu.org; Fri, 22 Oct 2021 00:58:09 -0400
Received: from lists.gnu.org ([209.51.188.17]:49980)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <jporterbugs@HIDDEN>) id 1mdmd5-00010q-T8
 for submit <at> debbugs.gnu.org; Fri, 22 Oct 2021 00:58:08 -0400
Received: from eggs.gnu.org ([2001:470:142:3::10]:37938)
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <jporterbugs@HIDDEN>)
 id 1mdmd5-00021Y-IV
 for bug-gnu-emacs@HIDDEN; Fri, 22 Oct 2021 00:58:07 -0400
Received: from mail-pg1-x533.google.com ([2607:f8b0:4864:20::533]:36439)
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.90_1) (envelope-from <jporterbugs@HIDDEN>)
 id 1mdmd1-0006HU-Qw
 for bug-gnu-emacs@HIDDEN; Fri, 22 Oct 2021 00:58:07 -0400
Received: by mail-pg1-x533.google.com with SMTP id 75so2277304pga.3
 for <bug-gnu-emacs@HIDDEN>; Thu, 21 Oct 2021 21:58:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=from:subject:to:cc:message-id:date:mime-version:content-language
 :content-transfer-encoding;
 bh=hvJGcbhYZLpEGRxE6NByVUbEDo7XK61DwYuIxjCJy5M=;
 b=QXHXVljBdGS0Aj9c1zINGDhLCuR9wmHyPIcxnvPabRDMJ+NlhK5lSQc+X2NcouQhvo
 hGKV9UDEWut4FaOYkXaL12uf1ZjC1Gjt+jEEcmHH1qZRlkeLUeGG6IFr6JaWQe3Lxryz
 +X633v+61QatKbSc0FebIfKPXVg0wjIHsA5Vphx8gfbPBMC7BParf6HsE20esVg2HBoQ
 p1u4xBQBinGh0SNHdHFtI3JwpRCHDM1EMMOBRYh2XsMYJlZ65CeUkHjeq2TKONe/Gmgi
 JpKtDR6h8B9YmV1DoUHgouW2AJudGw9EYUdDMzuRRQTGC/DQqfgz/aKuMqzVDdH0Irmh
 rhgA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=x-gm-message-state:from:subject:to:cc:message-id:date:mime-version
 :content-language:content-transfer-encoding;
 bh=hvJGcbhYZLpEGRxE6NByVUbEDo7XK61DwYuIxjCJy5M=;
 b=hPLapf1XK9UKlFrJA/miIrzLCcPdkhBe9v0WgVj05heI/nXI+3fs0UzdcSFW46OYiP
 H4SA7mXu3wqvR3NBYPTWXYZDfy5pTpkdvQef/qHoxX6/TEuQvdqpDuRlH7vCiG8OZuOz
 q0czJt08C1b/+aUBQaSTkfmabzea7jmCuryzgX8ZNzOybr/BCgDG28ofbQ2HbXrqWXuo
 t5Y/Mxk5qyz1DWyTa19YG2aofkwv0LB/b6hxVlCZ3JMEolxRp0YA8nCi1q20ddyUIm3B
 RytlRDguMCkfwU91giVMT75VRlVwlJ/PHkHy6nF7XDUB5TWWH1ivaqSeMES4d4yx52C+
 l7JQ==
X-Gm-Message-State: AOAM533rT7L8rF6RCKxzxpZqA3otCrDQkbzAOW7b0Gtz78+mikWltOTH
 drQSUMDqrVLbvbDjDvFI7QE=
X-Google-Smtp-Source: ABdhPJwFHPRO7Ldwvsfx6sjBwSXCz3ZDn+X01wCmKHMfa3uUqRmdaUa12cQz6uWuPyd9iuCsFEOVsw==
X-Received: by 2002:a63:b218:: with SMTP id x24mr7630645pge.29.1634878681443; 
 Thu, 21 Oct 2021 21:58:01 -0700 (PDT)
Received: from [192.168.1.2] (cpe-76-168-148-233.socal.res.rr.com.
 [76.168.148.233])
 by smtp.googlemail.com with ESMTPSA id u11sm8165835pfg.2.2021.10.21.21.58.00
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
 Thu, 21 Oct 2021 21:58:00 -0700 (PDT)
X-Mozilla-News-Host: news://news.gmane.org:119
From: Jim Porter <jporterbugs@HIDDEN>
Subject: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR when starting daemon
 on-demand
To: bug-gnu-emacs@HIDDEN
Message-ID: <ba5ee273-9d0f-7baf-ef2e-d0b005f29ed0@HIDDEN>
Date: Thu, 21 Oct 2021 21:58:00 -0700
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Received-SPF: pass client-ip=2607:f8b0:4864:20::533;
 envelope-from=jporterbugs@HIDDEN; helo=mail-pg1-x533.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.3 (-)
X-Debbugs-Envelope-To: submit
Cc: eggert@HIDDEN
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.3 (--)

Normally, when running `emacsclient --alternate-editor=""' with no Emacs 
server running, it will run `emacs --daemon' and then connect to it. In 
Emacs 28, it will also issue the following warning:

   Should XDG_RUNTIME_DIR='/run/user/1000' be in the environment?
   (Be careful: XDG_RUNTIME_DIR is security-related.)

However, XDG_RUNTIME_DIR *is* set in my environment, so it shouldn't be 
warning me about it.

I believe this is due to the fix for bug#33847 (see commit 
007744dd0404d6febca88b00c22981cc630fb8c0). That bug asked for 
emacsclient to look in both XDG_RUNTIME_DIR and TMPDIR to find the 
server socket, in order to accommodate the case where `emacs --daemon' 
is started when XDG_RUNTIME_DIR is unset, but *is* set when running 
`emacsclient'.

That works for the issue described in bug#33847, but for users with 
XDG_RUNTIME_DIR set who want `emacs --daemon' to start on demand, the 
change means that emacsclient will look in TMPDIR to find a server 
socket, record that attempt, and then warn about it before finally going 
ahead and starting `emacs --daemon'.

I'm not an expert on XDG_RUNTIME_DIR, but my understanding is that this 
was added to improve security over using TMPDIR. However, as far as I 
can tell, the fix in bug#33847 partially undoes the security improvement 
for users who want to start `emacs --daemon' on demand.

I'm not sure what the fix here is, at least not while ensuring that both 
this case and the case in bug#33847 "just work" without setting some 
option...

(The original bug#33847 is rather long, and I see that similar concerns 
were raised there, so I hope I've summarized this accurately and I'm not 
just misunderstanding what this code is doing.)




Acknowledgement sent to Jim Porter <jporterbugs@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-gnu-emacs@HIDDEN. Full text available.
Report forwarded to bug-gnu-emacs@HIDDEN:
bug#51327; Package emacs. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Fri, 5 Nov 2021 19:15:01 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.