#520 FreeBSD: the pidfile directory is writable by the service user

[Anonymous]

Originally created by: athanclark

FreeBSD: the pidfile directory is writable by the service user.

• /var/run/openchronology is created 0755 owned by the service user (openchronology.rc:32), so that user can replace the root-written supervisor pidfile.
• rc.subr only checks that the pid belongs to a daemon process. A compromised service user could therefore make service openchronology stop signal another daemon(8)-supervised service.
• Fix: a root-owned pid directory.

---

From the security review of 2026-11-06 (commit 6776c44), finding I-19: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed