Re: [PATCH] tools/power/x86/intel-speed-select: harden daemon pidfile open

[srinivas pandruvada]

Thanks for this change.

Capitalize the first letter. here it will be "Harden daemon pidfile
open"

On Thu, 2026-04-23 at 20:16 +0300, unknownbbqrx wrote:
> 
> Avoid symlink-based pidfile clobbering by opening the pidfile with
> O_NOFOLLOW and validating it with fstat() before locking/writing.
> 
> The daemon currently uses a fixed pidfile path under /tmp. A local
> unprivileged user can pre-create a symlink at that path and cause a
> root-run daemon instance to write into an attacker-chosen file.
> 
> Signed-off-by: unknownbbqrx <dev@xxxxxxxxxxxxxxx>

Please follow sign-off guidelines
https://docs.kernel.org/process/submitting-patches.html


Thanks,
Srinivas

> ---
>  tools/power/x86/intel-speed-select/isst-daemon.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/power/x86/intel-speed-select/isst-daemon.c
> b/tools/power/x86/intel-speed-select/isst-daemon.c
> index 66df21b2b..4346b049d 100644
> --- a/tools/power/x86/intel-speed-select/isst-daemon.c
> +++ b/tools/power/x86/intel-speed-select/isst-daemon.c
> @@ -200,11 +200,21 @@ static void daemonize(char *rundir, char
> *pidfile)
>  	if (ret == -1)
>  		exit(EXIT_FAILURE);
>  
> -	pid_file_handle = open(pidfile, O_RDWR | O_CREAT, 0600);
> +	pid_file_handle = open(pidfile, O_RDWR | O_CREAT |
> O_NOFOLLOW, 0600);
>  	if (pid_file_handle == -1) {
>  		/* Couldn't open lock file */
>  		exit(1);
>  	}
> +
> +	{
> +		struct stat st;
> +
> +		if (fstat(pid_file_handle, &st) == -1)
> +			exit(1);
> +
> +		if (!S_ISREG(st.st_mode))
> +			exit(1);
> +	}
>  	/* Try to lock file */
>  #ifdef LOCKF_SUPPORT
>  	if (lockf(pid_file_handle, F_TLOCK, 0) == -1) {
> 
> base-commit: 2e68039281932e6dc37718a1ea7cbb8e2cda42e6
> prerequisite-patch-id: b61dd51dee390277603975bf729a687113185c3a
> prerequisite-patch-id: df28525061dd528875c7c75880b4684d80f4aa7d