administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-19 21:22:50 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

don't follow a planted symlink when writing /dev/shm/go2rtc.yaml

Browse Source 
After the first start the go2rtc user owned /dev/shm/go2rtc.yaml and could swap it for a dangling symlink. The run script's -f test was false for a dangling link, so the link survived, and root's create_config.py then created the link target and the chown handed it to go2rtc. The run script now removes any existing entry, create_config.py creates the file with O_EXCL and O_NOFOLLOW at mode 0640, and the chown uses -h.
This commit is contained in:
Josh Hawkins
2026-10-18 12:07:17 -05:00
parent 72183983b0
commit 5d81da8c00
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run
+2 -2
View File
@@ -66,7 +66,7 @@ function set_libva_version() {
set_libva_version
if [[ -f "/dev/shm/go2rtc.yaml" ]]; then
if [[ -e "/dev/shm/go2rtc.yaml" || -L "/dev/shm/go2rtc.yaml" ]]; then
echo "[INFO] Removing stale config from last run..."
rm /dev/shm/go2rtc.yaml
fi
@@ -88,7 +88,7 @@ fi
readonly homekit_config_path="/config/go2rtc_homekit.yml"
if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
python3 /usr/local/go2rtc/prepare_homekit.py "${homekit_config_path}" --chown
chown go2rtc:go2rtc /dev/shm/go2rtc.yaml 2>/dev/null || true
chown -h go2rtc:go2rtc /dev/shm/go2rtc.yaml 2>/dev/null || true
else
python3 /usr/local/go2rtc/prepare_homekit.py "${homekit_config_path}"
fi