Merge pull request #48 from sewi-cpan/fix/tmp-symlink-vuln

Fix predictable /tmp path enabling symlink attack as root
Merge pull request #49 from FishyW/main
2026-08-26 17:35:02 +03:00 · 2026-08-17 11:48:57 +03:00 · 2026-08-17 11:48:29 +03:00 · 2026-08-14 11:53:34 +07:00 · 2026-08-11 08:08:40 +02:00
2 changed files with 7 additions and 3 deletions
@@ -32,7 +32,7 @@ install_deps() {
            apt-get install -y "${DEPS[@]}"
            ;;
        dnf)
-            dnf install -y "${DEPS[@]} python3-dnf-plugin-post-transaction-actions"
+            dnf install -y "${DEPS[@]}" python3-dnf-plugin-post-transaction-actions
            ;;
        pacman)
            pacman -Sy --needed --noconfirm "${DEPS[@]}"
@@ -31,7 +31,12 @@ fi

 #Config section
 readonly FIX_WIDEVINE=true
-readonly FIX_DIR='/tmp/opera-fix'
+FIX_DIR=$(mktemp -d -t opera-fix.XXXXXXXX)
+if [[ ! -d "$FIX_DIR" ]]; then
+	printf 'Failed to create a secure temporary directory\n'
+	exit 1
+fi
+readonly FIX_DIR
 readonly FFMPEG_SRC_MAIN='https://api.github.com/repos/Ld-Hagen/nwjs-ffmpeg-prebuilt/releases'
 readonly FFMPEG_SRC_ALT='https://api.github.com/repos/Ld-Hagen/fix-opera-linux-ffmpeg-widevine/releases'
 readonly WIDEVINE_SRC='https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/main/toolkit/content/gmp-sources/widevinecdm.json'
@@ -121,7 +126,6 @@ if $FIX_WIDEVINE; then
 fi

 #Downloading Widevine
-mkdir -p "$FIX_DIR"
 if $FIX_WIDEVINE; then
  printf 'Downloading Widevine CDM...\n'
  echo -e "From URL: $WIDEVINE_URL\n"
Author	SHA1	Message	Date
Maksim IvanovandGitHub	0150fa9bc9	Merge pull request #48 from sewi-cpan/fix/tmp-symlink-vuln Fix predictable /tmp path enabling symlink attack as root	2026-08-17 11:48:57 +03:00
Maksim IvanovandGitHub	b22229d589	Merge pull request #49 from FishyW/main Fix dnf install command in install.sh	2026-08-17 11:48:29 +03:00
WinstonandGitHub	07c8df08c6	Fix dnf install command in install.sh	2026-08-14 11:53:34 +07:00
Sebastian WillingandClaude Sonnet 5	42fe8e0176	Fix predictable /tmp path enabling symlink attack as root fix-opera.sh runs as root and used a fixed, world-guessable temp directory (/tmp/opera-fix) created with `mkdir -p`, which succeeds silently even if the path already exists. A local unprivileged user could pre-create /tmp/opera-fix as a symlink to a directory they control and place a malicious libffmpeg.so/libwidevinecdm.so there ahead of time. When an admin later ran this script, root would copy the attacker's library into Opera's lib_extra with 0644 perms, where it gets loaded into every user's browser process on the system. Switch to `mktemp -d`, which atomically creates a private (0700), unpredictably-named directory via a bare mkdir() syscall - exclusive by nature, so it can never adopt a pre-existing path or symlink the way `mkdir -p` does. Also drop the now-redundant mkdir -p call, since mktemp already creates the directory. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-11 08:08:40 +02:00