Take the daemon socket out of /tmp, and check who owns it

[YCistak]

/tmp/pylon.sock was chosen because /tmp exists on every Unix. It is also the one directory every other user on the machine can write to — and the daemon authenticates nobody. Whatever reaches that socket can run secret set, do, and listen, which opens the microphone.

Nothing checked who owned the socket either. On a shared machine that is enough:

1. Another local user binds /tmp/pylon.sock first — before Pylon's first run, or after the daemon exits and removes the name on shutdown.
2. The victim runs pylon secret set gemini <api-key>. It arrives at the attacker's socket in plaintext.
3. The victim's daemon cannot take the name back: the sticky bit stops it removing a file it does not own, so the squat holds.

Single-user machines were never exposed. This is a shared-machine problem, and it was a real one.

The fix, in four parts — the first alone would not be proof

• The socket moves to a directory only its owner may write to: $XDG_RUNTIME_DIR/pylon/ on Linux (/run/user/<uid>, made 0700 by the login session), /tmp/pylon-<uid>/ where there is no such variable. The shape tmux and gpg-agent use, for this reason.
• secureDir refuses a directory that belongs to someone else and tightens one that is merely loose. MkdirAll succeeds on a directory that already exists, whoever made it — which is exactly the case worth catching, since the fallback name is predictable.
• The socket is chmod 0600, not whatever the umask left. Connecting to a Unix socket needs write permission on it, so its mode is the last gate; 022 vs 002 should not be what decides.
• Clients check the owner before dialling. The daemon's protections are no help if the thing answering is not the daemon, and the first thing down that wire may be a secret.

pylon-ui carries its own copy of the path by design (separate module, cannot import internal/); it moves in step.

Verification

Live, after restarting the daemon:

$ ls -la /run/user/1000/pylon/
drwx------  2 asaf asaf   80 .
srw-------  1 asaf asaf    0 pylon.sock

$ ls /tmp/pylon.sock
ls: cannot access '/tmp/pylon.sock': No such file or directory

$ pylon status
running (pid 74794, uptime 17s), 0 pending task(s)

Was srwxr-xr-x in a world-writable directory; is now srw------- in a private one.

The refusal was checked against a socket that really belongs to someone else — /run/dbus/system_bus_socket, root-owned and srw-rw-rw-, so connecting would have worked:

refusing to talk to /run/dbus/system_bus_socket: it belongs to another user

Tests cover the private directory, tightening a loose one, idempotent restarts, the socket's mode after Listen, ownership accepted for our own socket and refused for another user's, that the refusal happens before the dial, and that the default path is never directly inside a world-writable directory. -race clean.

Upgrading

Restart the daemon — systemctl --user restart pylon, or close and reopen the window. One still listening on the old path will not be found and the CLI will report it as not running. PYLON_SOCKET and paths.socket override the default exactly as before.

Third and last PR from the security review, after #62 (dependencies) and #63 (input hardening).

🤖 Generated with Claude Code