🔒 [security fix] Move notification logs to secure directory#3
Conversation
Move `ha_notifications.log` from world-writable `/tmp` to `/Library/Logs/HomeAssistant/notifications.log` with restricted permissions (750). This mitigates potential symlink attacks, log injection, and unauthorized access to sensitive notification data. Changes: - Updated `config/default_config.yaml` with the new secure path. - Updated `docs/OFFICIAL_MACOS_GUIDE.md` documentation. - Modified `scripts/postinstall` to set secure (750) permissions on the log directory. - Modified `scripts/uninstall` to ensure cleanup of the new log path while maintaining legacy cleanup. Co-authored-by: Bwillou1 <162920784+Bwillou1@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
The vulnerability involved using the world-writable
/tmpdirectory for sensitive notification logs. This could allow a malicious local user to perform symlink attacks or inject false log entries.The fix moves the log file to
/Library/Logs/HomeAssistant/notifications.log, which is owned by the_homeassistantsystem user. Additionally, thepostinstallscript now sets the directory permissions to750, ensuring only the owner and group can access the logs. Theuninstallscript was also updated to explicitly clean up the new log file.PR created automatically by Jules for task 8838677968184243535 started by @Bwillou1