From dc9e74ca12397a9ababc74f031393e4ee4a34f3b Mon Sep 17 00:00:00 2001 From: Bernardo Magri Date: Sat, 30 May 2026 21:05:04 +0100 Subject: [PATCH] fix(scripts): use mktemp for state.json writes, not a fixed /tmp path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ten state-mutating sites across seven scripts wrote through a predictable, world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`) before the atomic `sudo mv`. Because the `>` redirect runs as the invoking user (sudo doesn't cover redirects), the shared fixed path is a symlink/ TOCTOU target and collides if two of these run concurrently. Switch each to a per-invocation `mktemp`; the atomic rename into place is unchanged. nomarchy-theme-set already used a temp var for its home-state write — this makes its system-state write consistent and cleans the temp up on failure. Co-Authored-By: Claude Opus 4.8 --- core/system/scripts/nomarchy-setup-dns | 4 ++-- core/system/scripts/nomarchy-setup-fido2 | 4 ++-- core/system/scripts/nomarchy-setup-fingerprint | 4 ++-- core/system/scripts/nomarchy-toggle-hybrid-gpu | 2 +- core/system/scripts/nomarchy-tz-select | 2 +- core/system/scripts/nomarchy-wifi-powersave | 2 +- themes/engine/scripts/nomarchy-theme-set | 2 +- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/core/system/scripts/nomarchy-setup-dns b/core/system/scripts/nomarchy-setup-dns index 01d2ecb..a59d207 100755 --- a/core/system/scripts/nomarchy-setup-dns +++ b/core/system/scripts/nomarchy-setup-dns @@ -14,7 +14,7 @@ fi case "$dns" in Cloudflare|Google|DHCP) - sudo jq --arg dns "$dns" '.dns = $dns' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" + tmp=$(mktemp); sudo jq --arg dns "$dns" '.dns = $dns' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" ;; Custom) @@ -28,7 +28,7 @@ Custom) # Convert to JSON array safely dns_array=$(echo "$dns_servers" | jq -R 'split(" ")') - sudo jq --arg dns "Custom" --argjson servers "$dns_array" '.dns = $dns | .customDns = $servers' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" + tmp=$(mktemp); sudo jq --arg dns "Custom" --argjson servers "$dns_array" '.dns = $dns | .customDns = $servers' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" ;; esac diff --git a/core/system/scripts/nomarchy-setup-fido2 b/core/system/scripts/nomarchy-setup-fido2 index 120894a..6fc26f3 100755 --- a/core/system/scripts/nomarchy-setup-fido2 +++ b/core/system/scripts/nomarchy-setup-fido2 @@ -6,13 +6,13 @@ set -e STATE_FILE="/etc/nixos/state.json" if [[ "--remove" == $1 ]]; then - sudo jq '.features.fido2 = false' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" + tmp=$(mktemp); sudo jq '.features.fido2 = false' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" echo "FIDO2 support disabled. Applying changes..." sudo nomarchy-sys-update exit 0 fi -sudo jq '.features.fido2 = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" +tmp=$(mktemp); sudo jq '.features.fido2 = true' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" echo "FIDO2 support enabled. Applying changes..." sudo nomarchy-sys-update diff --git a/core/system/scripts/nomarchy-setup-fingerprint b/core/system/scripts/nomarchy-setup-fingerprint index 18479f3..6cf81cc 100755 --- a/core/system/scripts/nomarchy-setup-fingerprint +++ b/core/system/scripts/nomarchy-setup-fingerprint @@ -6,13 +6,13 @@ set -e STATE_FILE="/etc/nixos/state.json" if [[ "--remove" == $1 ]]; then - sudo jq '.features.fingerprint = false' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" + tmp=$(mktemp); sudo jq '.features.fingerprint = false' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" echo "Fingerprint support disabled. Applying changes..." sudo nomarchy-sys-update exit 0 fi -sudo jq '.features.fingerprint = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" +tmp=$(mktemp); sudo jq '.features.fingerprint = true' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" echo "Fingerprint support enabled. Applying changes..." sudo nomarchy-sys-update diff --git a/core/system/scripts/nomarchy-toggle-hybrid-gpu b/core/system/scripts/nomarchy-toggle-hybrid-gpu index dc69ad0..6ad0998 100755 --- a/core/system/scripts/nomarchy-toggle-hybrid-gpu +++ b/core/system/scripts/nomarchy-toggle-hybrid-gpu @@ -9,7 +9,7 @@ STATE_FILE="/etc/nixos/state.json" # Check if supergfxd is enabled in config if [[ $(sudo jq -r '.features.hybridGPU // false' "$STATE_FILE") != "true" ]]; then if gum confirm "Hybrid GPU support is not enabled. Enable it now? (Requires sys-update)"; then - sudo jq '.features.hybridGPU = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" + tmp=$(mktemp); sudo jq '.features.hybridGPU = true' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" echo "Hybrid GPU support enabled in configuration. Applying changes..." sudo nomarchy-sys-update echo "Please run this command again after the update." diff --git a/core/system/scripts/nomarchy-tz-select b/core/system/scripts/nomarchy-tz-select index decda15..b92f0aa 100755 --- a/core/system/scripts/nomarchy-tz-select +++ b/core/system/scripts/nomarchy-tz-select @@ -7,7 +7,7 @@ STATE_FILE="/etc/nixos/state.json" timezone=$(timedatectl list-timezones | gum filter --height 20 --header "Set timezone") || exit 1 -sudo jq --arg tz "$timezone" '.timezone = $tz' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" +tmp=$(mktemp); sudo jq --arg tz "$timezone" '.timezone = $tz' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" echo "Timezone is now set to $timezone. Applying changes..." sudo nomarchy-sys-update diff --git a/core/system/scripts/nomarchy-wifi-powersave b/core/system/scripts/nomarchy-wifi-powersave index a6967fb..4a5073e 100755 --- a/core/system/scripts/nomarchy-wifi-powersave +++ b/core/system/scripts/nomarchy-wifi-powersave @@ -12,7 +12,7 @@ off) value="false" ;; *) echo "Usage: nomarchy-wifi-powersave "; exit 1 ;; esac -sudo jq --argjson val "$value" '.wifi.powersave = $val' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE" +tmp=$(mktemp); sudo jq --argjson val "$value" '.wifi.powersave = $val' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE" echo "Wifi powersave set to $1. Applying changes..." sudo nomarchy-sys-update diff --git a/themes/engine/scripts/nomarchy-theme-set b/themes/engine/scripts/nomarchy-theme-set index 57e5bb8..1098ec7 100755 --- a/themes/engine/scripts/nomarchy-theme-set +++ b/themes/engine/scripts/nomarchy-theme-set @@ -40,7 +40,7 @@ jq --arg theme "$THEME_NAME" '.theme = $theme' "$STATE_FILE" > "$TMP_JSON" && mv # Sync to system state if we have permissions (for system-level theming like browser policies) SYSTEM_STATE_FILE="/etc/nixos/state.json" if [ -w "$SYSTEM_STATE_FILE" ] || [ -w "/etc/nixos" ]; then - sudo jq --arg theme "$THEME_NAME" '.theme = $theme' "$SYSTEM_STATE_FILE" > /tmp/system-state.json 2>/dev/null && sudo mv /tmp/system-state.json "$SYSTEM_STATE_FILE" 2>/dev/null || true + tmp=$(mktemp); sudo jq --arg theme "$THEME_NAME" '.theme = $theme' "$SYSTEM_STATE_FILE" > "$tmp" 2>/dev/null && sudo mv "$tmp" "$SYSTEM_STATE_FILE" 2>/dev/null || rm -f "$tmp" fi # Try to find a background for this theme