diff options
| author | Karan Kurani <karankurani3k@gmail.com> | 2026-04-13 23:32:12 +0530 |
|---|---|---|
| committer | Eric Biggers <ebiggers3@gmail.com> | 2026-04-14 23:30:23 -0700 |
| commit | 2dee71cdc2a7bccead530a42dfd10736e8de45a9 (patch) | |
| tree | e41917046ca1f9fbc8f2df748066710bd26369eb /vendor/golang.org/x/crypto/ssh | |
| parent | 298ed2a6c44cde90b4262b884169c53b8deda508 (diff) | |
recovery: add O_NOFOLLOW|O_EXCL to prevent symlink-following in recovery file creation
WriteRecoveryInstructions() opens the recovery README with os.OpenFile
using O_WRONLY|O_CREATE without O_NOFOLLOW. When fscrypt encrypt runs
as root, this allows a local attacker to place a symlink at the recovery
file path, causing root to write through the symlink and then fchown the
target file to the attacker. Adding O_EXCL|O_NOFOLLOW aligns with the
existing security pattern in filesystem.go:608 and filesystem.go:747.
Diffstat (limited to 'vendor/golang.org/x/crypto/ssh')
0 files changed, 0 insertions, 0 deletions