Skip to content

utils: create the extcap FIFO with owner-only permissions - #5127

Open
KernelClint wants to merge 1 commit into
secdev:masterfrom
KernelClint:extcap-fifo-owner-only
Open

utils: create the extcap FIFO with owner-only permissions#5127
KernelClint wants to merge 1 commit into
secdev:masterfrom
KernelClint:extcap-fifo-owner-only

Conversation

@KernelClint

Copy link
Copy Markdown
Contributor

Scapy reads from an external capture helper through a named pipe: get_temp_file() makes a
temporary file, the pipe replaces it, and the helper writes capture bytes into it while Scapy reads
the other end.

The temporary file is created mode 0600, and then
scapy/utils.py:233-248
unlinks it and calls os.mkfifo() with no mode:

os.unlink(fname)
os.mkfifo(fname)

os.mkfifo() defaults to 0666, filtered only by the process umask. With the common default of
022 the pipe ends up world-readable, in a directory that is usually shared. Another account on
the machine can open the read side; pipe readers split a byte stream rather than each receiving a
copy, so that also leaves Scapy with a partial capture.

The change passes the mode the replaced file already had:

-    os.mkfifo(fname)
+    os.mkfifo(fname, 0o600)

Scapy and the helper it starts both run as the owner, so nothing that worked before stops working.

The added regression asserts the FIFO's mode is 0600 regardless of the umask in force. Removing
the mode argument makes it fail.

Performance was measured on one computer, before and after the fix: a capture round trip took
126.8 µs before and 123.3 µs after. Repeat runs of the same test moved by about 2%, so that
difference is smaller than the test can distinguish.

@codecov

codecov Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.64%. Comparing base (b3bbcc8) to head (48d4398).

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #5127   +/-   ##
=======================================
  Coverage   80.63%   80.64%           
=======================================
  Files         390      390           
  Lines       96936    96936           
=======================================
+ Hits        78168    78170    +2     
+ Misses      18768    18766    -2     
Files with missing lines Coverage Δ
scapy/utils.py 72.59% <100.00%> (ø)

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant