Linuxfabrik monitoring plugins: symlink attack on predictable /tmp SQLite caches lets a local user write as root

Impact

The monitoring library created its SQLite cache databases at fixed, predictable paths in /tmp and followed symlinks placed there. A local account that can pre-create, for example, /tmp/linuxfabrik-monitoring-plugins-docker-stats.db as a symlink and then trigger a sudo-authorized plugin gets the root process to create or write the link target. That is an arbitrary-write primitive as root, usable to clobber files, cause denial of service, or tamper with an existing SQLite database through a crafted rollback journal or WAL. Monitoring agents run on every node in a fleet and are commonly wired into sudoers, so this turns a low-privilege shell on a GPU node into node-level file tampering.

Who can reach it

A local user on a monitored host who can write to /tmp and can cause a sudo-authorized monitoring plugin to run. No remote access and no monitoring-server credentials are needed.

What to do

Upgrade linuxfabrik-lib to 4.2.0 or later, which moves plugin caches to a secured per-user directory via lib.db_sqlite.get_db_path(); update the monitoring-plugins package alongside it so the plugins use the new path. Remove any stale /tmp/linuxfabrik-*.db files after the upgrade. No reboot needed - the plugins are invoked per check.

References