Security: install stale-sweep executes candidate binaries from user-writable dirs #274

New issue

Closed

opened 2026-07-19 03:50:46 +00:00 by hexajon · 0 comments

hexajon commented

2026-07-19 03:50:46 +00:00

(Migrated from codeberg.org)

The madtea install stale-copy sweep probes each candidate's version by executing it: getInstalledVersion runs exec.Command(candidate, "--version") (internal/cmd/install/install.go:942). The candidate directory list includes user-writable locations - ~/.local/bin and $GOBIN/$GOPATH/bin (staleCandidates, internal/cmd/install/install.go:754-761).

So madtea install executes any binary named madtea/mad-tea found in those dirs. Scenario: a local attacker or a malicious package drops a trojan madtea into ~/.local/bin or $GOPATH/bin; the next madtea install runs it.

Severity: low. It runs as the invoking user before any sudo elevation, and anyone who can write those dirs already controls an early-PATH madtea binary - so the marginal escalation is small. Worth hardening anyway.

Fix: skip the --version probe for candidates located in user-writable dirs, or stat-and-check-owner before executing (only probe root-owned / trusted-dir candidates).

Acceptance: the sweep no longer executes a madtea binary from a user-writable directory to determine its version; a test covers the skip.

The `madtea install` stale-copy sweep probes each candidate's version by executing it: `getInstalledVersion` runs `exec.Command(candidate, "--version")` (`internal/cmd/install/install.go:942`). The candidate directory list includes user-writable locations - `~/.local/bin` and `$GOBIN`/`$GOPATH/bin` (`staleCandidates`, `internal/cmd/install/install.go:754-761`). So `madtea install` executes any binary named `madtea`/`mad-tea` found in those dirs. Scenario: a local attacker or a malicious package drops a trojan `madtea` into `~/.local/bin` or `$GOPATH/bin`; the next `madtea install` runs it. Severity: low. It runs as the invoking user before any sudo elevation, and anyone who can write those dirs already controls an early-PATH `madtea` binary - so the marginal escalation is small. Worth hardening anyway. Fix: skip the `--version` probe for candidates located in user-writable dirs, or stat-and-check-owner before executing (only probe root-owned / trusted-dir candidates). Acceptance: the sweep no longer executes a `madtea` binary from a user-writable directory to determine its version; a test covers the skip.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#274

No description provided.

Rows
Columns