From 42fe8e01765dd2b55f1155e2c10b4da6516d548b Mon Sep 17 00:00:00 2001 From: Sebastian Willing Date: Tue, 11 Aug 2026 08:08:40 +0200 Subject: [PATCH] Fix predictable /tmp path enabling symlink attack as root fix-opera.sh runs as root and used a fixed, world-guessable temp directory (/tmp/opera-fix) created with `mkdir -p`, which succeeds silently even if the path already exists. A local unprivileged user could pre-create /tmp/opera-fix as a symlink to a directory they control and place a malicious libffmpeg.so/libwidevinecdm.so there ahead of time. When an admin later ran this script, root would copy the attacker's library into Opera's lib_extra with 0644 perms, where it gets loaded into every user's browser process on the system. Switch to `mktemp -d`, which atomically creates a private (0700), unpredictably-named directory via a bare mkdir() syscall - exclusive by nature, so it can never adopt a pre-existing path or symlink the way `mkdir -p` does. Also drop the now-redundant mkdir -p call, since mktemp already creates the directory. Co-Authored-By: Claude Sonnet 5 --- scripts/fix-opera.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) mode change 100644 => 100755 scripts/fix-opera.sh diff --git a/scripts/fix-opera.sh b/scripts/fix-opera.sh old mode 100644 new mode 100755 index 228e784..7901c3b --- a/scripts/fix-opera.sh +++ b/scripts/fix-opera.sh @@ -31,7 +31,12 @@ fi #Config section readonly FIX_WIDEVINE=true -readonly FIX_DIR='/tmp/opera-fix' +FIX_DIR=$(mktemp -d -t opera-fix.XXXXXXXX) +if [[ ! -d "$FIX_DIR" ]]; then + printf 'Failed to create a secure temporary directory\n' + exit 1 +fi +readonly FIX_DIR readonly FFMPEG_SRC_MAIN='https://api.github.com/repos/Ld-Hagen/nwjs-ffmpeg-prebuilt/releases' readonly FFMPEG_SRC_ALT='https://api.github.com/repos/Ld-Hagen/fix-opera-linux-ffmpeg-widevine/releases' readonly WIDEVINE_SRC='https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/main/toolkit/content/gmp-sources/widevinecdm.json' @@ -121,7 +126,6 @@ if $FIX_WIDEVINE; then fi #Downloading Widevine -mkdir -p "$FIX_DIR" if $FIX_WIDEVINE; then printf 'Downloading Widevine CDM...\n' echo -e "From URL: $WIDEVINE_URL\n"