T09 · Insecure Skill Coding Practices
Warning
- Location
- bin/watchdog.sh:8
- Finding
- Predictable Log File in a Shared Temporary Directory Permits Symlink Attacks## Vulnerability Details **File Location**: `bin/watchdog.sh`, lines 8-10 **Vulnerability Type**: Unsafe temporary file handling and symlink following **Risk Level**: Medium ### Vulnerable Code ```bash LOG_FILE="/tmp/openclaw-watchdog.log" echo "[$(date)] Watchdog starting..." >> "$LOG_FILE" ``` ### Technical Analysis The watchdog appends log data to the fixed, predictable path `/tmp/openclaw-watchdog.log`. Because `/tmp` is normally shared and writable by local users, another user can create that path before the watchdog runs. Shell redirection follows symbolic links, and the script does not verify the file type, ownership, or permissions before writing. This creates a time-of-check/time-of-use and symlink-following weakness. The attacker must be able to create or replace the predictable path, while the watchdog's execution identity must have permission to append to the symlink target. ### Attack Path 1. A local attacker observes that the watchdog always writes to `/tmp/openclaw-watchdog.log`. 2. The attacker creates that path as a symbolic link to another file. 3. A more privileged or otherwise targeted user runs `bin/watchdog.sh`. 4. The shell follows the symbolic link while processing the append redirection. 5. The watchdog appends its timestamped message to the attacker-selected target if the execution identity can write to it. This does not provide arbitrary file content because the appended text is fixed apart from the date, but it can alter or corrupt a writable target. ### Impact Assessment Exploitation requires local access and does not independently grant code execution or additional privileges. It can cause unauthorized file modification under the watchdog process's existing privileges. If the script is run with elevated privileges, the scope may include privileged writable files; if run as a normal user, impact is limited to files writable by that user. The fixed log path can also allow log tamperin ...[truncated 23 chars]
- Remediation
- ## Remediation Suggestions - Store logs in a private directory such as `$HOME/.openclaw/logs`, with the directory mode set to `0700`. - Create the log file securely with restrictive permissions, such as `0600`. - Reject symbolic links and verify that any existing destination is a regular file owned by the expected user. - If temporary storage is required, create a private directory using `mktemp -d` and clean it up with a trap. - Avoid running the watchdog as root unless elevated privileges are strictly necessary. - Consider using the system logging facility instead of manually writing to a shared temporary path.