Unlink bash tool output temp file on job cleanup#540
Open
gigioneggiando wants to merge 1 commit into
Open
Conversation
agent_bash_start() creates a per-job output file with mkstemp() and stores it in job->path. Only that function's error paths unlink it; the normal cleanup path agent_bash_job_free() closes the fds and frees memory but never unlinks job->path. A process that runs many bash-tool jobs therefore leaves a /tmp/ds4_agent_output_* file behind for each one, accumulating without bound for the lifetime of the process. Unlink job->path in agent_bash_job_free() before freeing the job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
agent_bash_start()creates a per-job output file withmkstemp()and stores its path injob->path. Only that function's own error pathsunlink()it. The normal cleanup path,agent_bash_job_free(), closes the file descriptors and frees memory but never unlinksjob->path.A process that runs many bash-tool jobs therefore leaves one
/tmp/ds4_agent_output_*file behind per job, accumulating without bound for the lifetime of the process (a slow resource leak on long-running agent sessions).Fix
unlink(job->path)inagent_bash_job_free()before freeing the job.Verification
Ran the real
agent_bash_start()+agent_bash_job_free()cleanup path for 3 jobs:/tmp/ds4_agent_output_*files after cleanup.Found during a coordinated security review of ds4; a standalone offline PoC is available on request.