From 48d43982a906b76da42c6ae28ba97bdd5e9b17c7 Mon Sep 17 00:00:00 2001
From: Clinton Thomas <1033162+KernelClint@users.noreply.github.com>
Date: Tue, 1 Sep 2026 13:29:01 -0400
Subject: [PATCH] utils: create the extcap FIFO with owner-only permissions

AI-Assisted: yes (GPT-5.6-Cyber)
---
 scapy/utils.py      |  2 +-
 test/regression.uts | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/scapy/utils.py b/scapy/utils.py
index 0879f3322bf..0447e553de0 100644
--- a/scapy/utils.py
+++ b/scapy/utils.py
@@ -244,7 +244,7 @@ def _create_fifo() -> Tuple[str, Any]:
     else:
         f = get_temp_file()
         os.unlink(f)
-        os.mkfifo(f)
+        os.mkfifo(f, 0o600)
         return f, f
 
 
diff --git a/test/regression.uts b/test/regression.uts
index 8a5dd3e460f..04403112e62 100644
--- a/test/regression.uts
+++ b/test/regression.uts
@@ -472,6 +472,23 @@ conf.prog.extcap_folders = _bkp_extcap
 conf.ifaces.providers = _bkp_providers
 conf.ifaces.reload()
 
+= Extcap FIFO is accessible only by its owner
+
+import stat
+from scapy.utils import _create_fifo
+
+if not WINDOWS:
+    old_umask = os.umask(0o022)
+    try:
+        fifo, _ = _create_fifo()
+    finally:
+        os.umask(old_umask)
+    try:
+        assert stat.S_IMODE(os.stat(fifo).st_mode) == 0o600
+    finally:
+        os.unlink(fifo)
+        conf.temp_files.remove(fifo)
+
 = Test read_routes6() - default output
 
 routes6 = read_routes6()