#882040 Something in Firefox writes to /tmp/tmpaddon

Package:
firefox
Source:
firefox
Description:
Mozilla Firefox web browser
Submitter:
Josh Triplett
Date:
2017-11-18 08:15:06 UTC
Severity:
normal
#882040#3
Date:
2017-11-17 22:32:43 UTC
From:
To:
Something in Firefox seems to be writing addons to /tmp/tmpaddon as part
of the installation process. (Mentions in bugs like
https://bugzilla.mozilla.org/show_bug.cgi?id=1385303 seem to confirm
this.) This needs confirmation to make sure it isn't an insecure
tempfile vulnerability, but even if it isn't, it *should* be using a
secure temporary file name to avoid conflict with other users.
#882040#8
Date:
2017-11-17 23:07:50 UTC
From:
To:
/tmp/tmpaddon: Zip archive data, at least v2.0 to extract
~$ unzip -l /tmp/tmpaddon
Archive:  /tmp/tmpaddon
  Length      Date    Time    Name
---------  ---------- -----   ----
      116  2017-08-21 20:25   gmpopenh264.info
  1407459  2017-08-21 20:25   libgmpopenh264.so
---------                     -------
  1407575                     2 files

So that's an additional concern: Firefox *shouldn't* be downloading or
using OpenH264.  It shows up as "disabled" under about:plugins and
about:addons.

- Josh Triplett
#882040#13
Date:
2017-11-17 23:03:21 UTC
From:
To:
toolkit/mozapps/extensions/internal/ProductAddonChecker.jsm does:
  let f = await OS.File.openUnique(OS.Path.join(OS.Constants.Path.tmpDir, "tmpaddon"))

toolkit/mozapps/extensions/internal/XPIProvider.jsm does:
  let path = OS.Path.join(OS.Constants.Path.tmpDir, "tmpaddon");
  let unique = await OS.File.openUnique(path);

Those are the only two references to "tmpaddon", and openUnique creates
unique file names with the given prefix. So this shouldn't be happening.

Mike
#882040#16
Date:
2017-11-18 08:14:22 UTC
From:
To:
-=| Mike Hommey, 18.11.2017 08:03:21 +0900 |=-

Still, 'install -d -m 0700 /tmp/tmpaddon' would prevent other users
from installing add-ons, wouldn't it?