Sebastian WillingandClaude Sonnet 5 42fe8e0176 Fix predictable /tmp path enabling symlink attack as root ...

fix-opera.sh runs as root and used a fixed, world-guessable temp
directory (/tmp/opera-fix) created with `mkdir -p`, which succeeds
silently even if the path already exists. A local unprivileged user
could pre-create /tmp/opera-fix as a symlink to a directory they
control and place a malicious libffmpeg.so/libwidevinecdm.so there
ahead of time. When an admin later ran this script, root would copy
the attacker's library into Opera's lib_extra with 0644 perms, where
it gets loaded into every user's browser process on the system.

Switch to `mktemp -d`, which atomically creates a private (0700),
unpredictably-named directory via a bare mkdir() syscall - exclusive
by nature, so it can never adopt a pre-existing path or symlink the
way `mkdir -p` does. Also drop the now-redundant mkdir -p call, since
mktemp already creates the directory.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-11 08:08:40 +02:00

..

99fix-opera

Reworked install / uninstall

2025-12-30 19:53:58 -05:00

fix-opera.action

Reworked install / uninstall

2025-12-30 19:53:58 -05:00

fix-opera.hook

Reworked install / uninstall

2025-12-30 19:53:58 -05:00

fix-opera.sh

Fix predictable /tmp path enabling symlink attack as root

2026-08-11 08:08:40 +02:00