T09 · Insecure Skill Coding Practices
Error
- Location
start.sh:6- Finding
Predictable Temporary Files Permit Token Disclosure, Symlink Attacks, and PID Manipulation
- Content
View full analysis
/dev/null; then kill "$pid" 2>/dev/null for i in $(seq 1 10); do kill -0 "$pid" 2>/dev/null || break sleep 0.5 done if kill -0 "$pid" 2>/dev/null; then kill -9 "$pid" 2>/dev/null fi echo "已停止旧进程 (PID: $pid)" fi rm -f "$RELAY_PID_FILE" fi } ``` ```bash nohup python3 -u relay.py > "$LOG_FILE" 2>&1 & RELAY_PID=$! echo "$RELAY_PID" > "$RELAY_PID_FILE" ``` ```python print(f" Auth token: {AUTH_TOKEN}") token_path = Path("/tmp/browser-relay-token") token_path.touch(mode=0o600, exist_ok=True) token_path.write_text(AUTH_TOKEN) os.chmod(token_path, stat.S_IRUSR | stat.S_IWUSR) ``` ### Technical Analysis The relay uses fixed, globally predictable paths under `/tmp` for its token, PID, and log files. Neither the shell script nor the Python implementation verifies that these paths are regular files owned by the current user and not symbolic links. The token file is opened through `Path.touch()` and `Path.write_text()`, both of which follow symbolic links. Applying `chmod()` afterward does not prevent the attack because the target may already have been overwritten. The operation can also unexpectedly change the permissions of the symlink target. The token is printed to standard output, while `start.sh` redirects standard output to `/tmp/relay.log`. The log is not explicitly created with restrictive perm ...[truncated 2262 chars]- Remediation
View remediation
/cmdline`, executable identity, process owner, and preferably process start time before sending a signal. 8. Use a supervisor or process handle instead of trusting a reusable numeric PID where possible. 9. Remove token and PID files during orderly shutdown and rotate the token after any suspected disclosure. ]]>