Description
PID files are written and read from /tmp without atomic creation, ownership checks, or file locking. Because the paths are predictable and the write/read logic does not verify file type/ownership, an unprivileged user can create or replace these files (or a symlink) so that telos stop / telos status reads and acts on a forged PID. This is a local TOCTOU/hijack vulnerability that can cause incorrect process control or denial-of-service.
Location
- telos_cli.py — writes
/tmp/telos_daemon.pid, /tmp/telos_cortex.pid
telos_tui/main.go — writes /tmp/telos_tui.pid
Steps to Reproduce
- As an unprivileged user, create a forged PID file:
# create a forged PID file (use an arbitrary PID)
printf "12345\n" > /tmp/telos_daemon.pid
- As the operator, run the CLI that reads the PID file:
sudo ./telos stop
sudo ./telos status
- Observe the orchestrator reads
/tmp/telos_daemon.pid and reports/acts on the forged PID. Example (illustrative):
Stopping Telos Daemon (PID: 12345) # 12345 is attacker-controlled, not the real daemon
Expected Behavior
- PID files should be created and handled securely:
- Create atomically (write to a temporary file then
rename() / os.replace()).
- Reject symlinks and verify the PID file is a regular file.
- Check file ownership/permissions before trusting contents.
- Use file locking (
flock) to reduce TOCTOU windows.
- Prefer runtime-owned directory (e.g.,
/run or /var/run) instead of /tmp.
Actual Behavior
- PID files are written to
/tmp without atomic writes, ownership checks, or locking. The orchestrator may therefore read and act on forged/stale PIDs created by unprivileged users.
Affected Files
- telos_cli.py
telos_tui/main.go
Additional Context
- Atomically write PID files (temp file →
os.replace()/rename()), or use exclusive create semantics (O_CREAT|O_EXCL).
- Validate file type (no symlinks) and ownership before using the PID.
- Use
flock around PID read/write operations.
- Prefer
/run or /var/run for daemon PID files and ensure the directory has appropriate permissions.
- Add tests simulating forged PID files to verify
telos stop / status refuse unsafe PID files.
Description
PID files are written and read from
/tmpwithout atomic creation, ownership checks, or file locking. Because the paths are predictable and the write/read logic does not verify file type/ownership, an unprivileged user can create or replace these files (or a symlink) so thattelos stop/telos statusreads and acts on a forged PID. This is a local TOCTOU/hijack vulnerability that can cause incorrect process control or denial-of-service.Location
/tmp/telos_daemon.pid,/tmp/telos_cortex.pidtelos_tui/main.go— writes/tmp/telos_tui.pidSteps to Reproduce
/tmp/telos_daemon.pidand reports/acts on the forged PID. Example (illustrative):Stopping Telos Daemon (PID: 12345) # 12345 is attacker-controlled, not the real daemonExpected Behavior
rename()/os.replace()).flock) to reduce TOCTOU windows./runor/var/run) instead of/tmp.Actual Behavior
/tmpwithout atomic writes, ownership checks, or locking. The orchestrator may therefore read and act on forged/stale PIDs created by unprivileged users.Affected Files
telos_tui/main.goAdditional Context
os.replace()/rename()), or use exclusive create semantics (O_CREAT|O_EXCL).flockaround PID read/write operations./runor/var/runfor daemon PID files and ensure the directory has appropriate permissions.telos stop/statusrefuse unsafe PID files.