Skip to content

Harden wallpaper reads against special-file DoS - #503

Closed
zyads wants to merge 373 commits into
pop-os:masterfrom
zyads:harden-wallpaper-read
Closed

Harden wallpaper reads against special-file DoS#503
zyads wants to merge 373 commits into
pop-os:masterfrom
zyads:harden-wallpaper-read

Conversation

@zyads

@zyads zyads commented Jul 31, 2026

Copy link
Copy Markdown

UserData::load_wallpapers_as_user reads each wallpaper with a plain fs::read on a path taken from that user's own cosmic-bg config, and the greeter daemon loads every user's config at the login/lock screen. Pointing that path at a FIFO blocks the read forever, and a device like /dev/zero reads without bound until the daemon is OOM-killed, so a single unprivileged user can deny the graphical login/lock screen to the whole machine.

Read wallpapers through a helper that opens with O_NONBLOCK, requires a regular file, and caps the read at 256 MiB, mirroring the defensive handling already applied to the AccountsService icon read. Verified with cargo check -p cosmic-greeter-daemon.

🤖 Generated with Claude Code


  • I have disclosed use of any AI generated code in my commit messages.
    • If you are using an LLM, and do not fully understand the changes it is making to the code base, do not create a PR.
    • In our experience, AI generated code often results in overly complex code that lacks enough context for a proper fix or feature inclusion. This results in considerably longer code reviews. Due to this, AI authored or partially authored PRs may be closed without comment.
  • I understand these changes in full and will be able to respond to review comments.
  • My change is accurately described in the commit message.
  • My contribution is tested and working as described.
  • I have read the Developer Certificate of Origin and certify my contribution under its conditions.

dongfengweixiao and others added 30 commits July 23, 2024 17:11
Updated some of the Chinese translations in zh_CN/cosmic_greeter.ftl for more accurate expression of meaning.
Hello,
This commit updates the french translations for system actions in Cosmic Files. Notable changes include:
    Keyboard layout: "Disposition du clavier"
    Suspend: "Mettre en veille"
    User: "Utilisateur"
Other translations remain unchanged.
Best regards,
Roxfr
Copied from cosmic-comp. Software rendering isn't all that usable
unoptimized. `dev` builds are more practical to test with some
optimization like this.
added italian l18n
Hide battery status on devices without a battery
Mostly closes: pop-os#103

Analogous to my other patches that localize date strings (e.g.
pop-os/cosmic-files#277).

The "password:" prompt is not localized in this patch because PAM should
yield translated strings on its own. This needs further investigation.
…e-datetime-password-prompt

Localize date strings
i18n(pt): Add Portuguese translation
…-user-session-choice

Default to user's previously selected session
mmstick and others added 23 commits April 29, 2026 00:21
- [x] I have disclosed use of any AI generated code in my commit
messages.
- If you are using an LLM, and do not fully understand the changes it is
making to the code base, do not create a PR.
- In our experience, AI generated code often results in overly complex
code that lacks enough context for a proper fix or feature inclusion.
This results in considerably longer code reviews. Due to this, AI
authored or partially authored PRs may be closed without comment.
- [x] I understand these changes in full and will be able to respond to
review comments.
- [x] My change is accurately described in the commit message.
- [x] My contribution is tested and working as described.
- [x] I have read the [Developer Certificate of
Origin](https://developercertificate.org/) and certify my contribution
under its conditions.
contains a fix for iced described in
pop-os/cosmic-comp#2096 &
pop-os/libcosmic#1253
Co-authored-by: BoneNI <bounkirdni@gmail.com>
Co-authored-by: Dan <jonweblin2205@protonmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Марко М. Костић <marko.m.kostic@gmail.com>
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/sr/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/uk/
Translation: Pop OS/COSMIC Greeter
Co-authored-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Isaac Subirana <isaacsubiranac@gmail.com>
Co-authored-by: Nara Díaz Viñolas <nara.diaz.vinolas@gmail.com>
Co-authored-by: therealmate <hellogaming91@gmail.com>
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/ca/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/hu/
Translation: Pop OS/COSMIC Greeter
…os#464)

- [X] I have disclosed use of any AI generated code in my commit
messages.
- If you are using an LLM, and do not fully understand the changes it is
making to the code base, do not create a PR.
- In our experience, AI generated code often results in overly complex
code that lacks enough context for a proper fix or feature inclusion.
This results in considerably longer code reviews. Due to this, AI
authored or partially authored PRs may be closed without comment.
- [X] I understand these changes in full and will be able to respond to
review comments.
- [X] My change is accurately described in the commit message.
- [X] My contribution is tested and working as described.
- [X] I have read the [Developer Certificate of
Origin](https://developercertificate.org/) and certify my contribution
under its conditions.

This is a small fix to autofill correct defaults for SOURCE_DATE_EPOCH
and SOURCE_GIT_HASH when running `just vendor`. See
pop-os/cosmic-epoch#3571 for further context.
Co-authored-by: CYAXXX <85353920+CYAXXX@users.noreply.github.com>
Co-authored-by: Fedorov Alexei <aleksejfedorov963@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/kmr/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/ru/
Translation: Pop OS/COSMIC Greeter
Co-authored-by: Andi Chandler <andi@gowling.com>
Co-authored-by: Ettore Atalan <atalanttore@googlemail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Prasanta-Hembram <Prasantahembram720@gmail.com>
Co-authored-by: Saeed <s.zare.org.82@gmail.com>
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/de/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/en_GB/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/fa/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/sat/
Translation: Pop OS/COSMIC Greeter
i18n: translation updates from weblate






Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/de/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/en_GB/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/fa/
Translate-URL: https://hosted.weblate.org/projects/pop-os/cosmic-greeter/sat/
Translation: Pop OS/COSMIC Greeter

Co-authored-by: Andi Chandler <andi@gowling.com>
Co-authored-by: Ettore Atalan <atalanttore@googlemail.com>
Co-authored-by: Prasanta-Hembram <Prasantahembram720@gmail.com>
Co-authored-by: Saeed <s.zare.org.82@gmail.com>
Downstream distributions have optional logind, but the logind feature
must be defined at compile time. If cosmic-greeter is compiled with
logind support it fails to run on a host that's not running logind.

Detect whether logind is present at runtime, enabling the use of the
same binaries regardless of whether logind is installed or not.
@zyads zyads changed the title Harden wallpaper reads against special-file DoS (FIFO/device path hangs greeter) Harden wallpaper reads against special-file DoS Jul 31, 2026
UserData::load_wallpapers_as_user read wallpapers with a plain fs::read on a
path taken from the user's own cosmic-bg config. A user could point it at a
FIFO (blocks open forever) or a device like /dev/zero (unbounded read, OOM).
Since the greeter loads every user's config at the login/lock screen, one
user could deny the login screen to the whole machine.

Read through a helper that opens O_NONBLOCK, requires a regular file, and
caps the read size.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@zyads
zyads force-pushed the harden-wallpaper-read branch from 7ae02e5 to da127cd Compare July 31, 2026 03:12
@zyads zyads closed this Aug 4, 2026
@zyads
zyads force-pushed the harden-wallpaper-read branch from da127cd to ad2ca08 Compare August 4, 2026 03:19
@zyads
zyads deleted the harden-wallpaper-read branch August 4, 2026 03:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.