bernardo/Nomarchy
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(scripts): use mktemp for state.json writes, not a fixed /tmp path
All checks were successful
Check / eval-and-lint (push) Successful in 6m57s
Details

Browse Source 
Ten state-mutating sites across seven scripts wrote through a predictable,
world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`)
before the atomic `sudo mv`. Because the `>` redirect runs as the invoking
user (sudo doesn't cover redirects), the shared fixed path is a symlink/
TOCTOU target and collides if two of these run concurrently. Switch each
to a per-invocation `mktemp`; the atomic rename into place is unchanged.
nomarchy-theme-set already used a temp var for its home-state write — this
makes its system-state write consistent and cleans the temp up on failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Bernardo Magri
2026-05-30 21:05:04 +01:00
parent 95d36f8ec7
commit dc9e74ca12
7 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/system/scripts/nomarchy-setup-fingerprint
View File

@@ -6,13 +6,13 @@ set -e
STATE_FILE="/etc/nixos/state.json"
if [[ "--remove" == $1 ]]; then
sudo jq '.features.fingerprint = false' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
tmp=$(mktemp); sudo jq '.features.fingerprint = false' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
echo "Fingerprint support disabled. Applying changes..."
sudo nomarchy-sys-update
exit 0
fi
sudo jq '.features.fingerprint = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
tmp=$(mktemp); sudo jq '.features.fingerprint = true' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
echo "Fingerprint support enabled. Applying changes..."
sudo nomarchy-sys-update