Post #958605

This is not a systemd flaw. This is a snap bug. The main reason behind this issue is the interaction between two system components. The first is snap-confine, which manages sandboxing for snap applications. The second is systemd-tmpfiles, which handles automatic cleanup of temporary files. Both are safe individually, but together they create a timing-based weakness. The attack works in a simple but smart way and does not require complex steps. Ubuntu automatically deletes old files from the /tmp directory after a certain number of days. During this cleanup, an important directory used by snap-confine may get removed. This creates an opportunity for the attacker to act. Once the directory is deleted, the attacker quickly recreates it with malicious content. These files are placed in a way that tricks the system into trusting them. When a snap application runs again, the system may load these files. Since snap-confine runs with higher privileges, the attacker’s code gets executed as root. systemd cleans up /tmp periodically. That’s it. No bug or exploit. snap-confine is the program that reads files from /tmp and trusts the content without checking ownership. Calling it a “systemd cleanup timing flaw” is inaccurate. This is entirely the fault of snap-confine.