[mlim19]

Description

touch_path() in gprofiler/utils/__init__.py used Path.touch() followed by os.chmod(), both of which follow a pre-existing final symlink. When gProfiler runs as root, a malicious profiled container could plant a symlink at a predictable async-profiler log/output path and cause gProfiler to chmod an attacker-chosen host file to 0o622.

This does not require winning a tight race: for a given Java PID the async-profiler filename is stable across profiling cycles, so the container can plant the symlink after one cycle removes the file and before the next cycle's touch_path() runs.

Fix

• Open the path with os.open(..., O_NOFOLLOW) so the kernel atomically rejects a symlink final component (raises ELOOP).
• Use os.fchmod(fd, mode) on the resulting file descriptor instead of path-based os.chmod(), eliminating the TOCTOU window and bypassing umask (preserving the exact mode the callers expect).

This mirrors the existing hardening already applied to safe_copy() and safe_read_text().

Related Issue

#1056

How Has This Been Tested?

Covered by the existing Java profiler tests in CI, which exercise touch_path() for async-profiler output/log files. Legitimate paths are regular files, not symlinks, so behavior is unchanged.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new open mode can block indefinitely on an attacker-created FIFO, and the security behavior lacks focused regression coverage.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Prevent blocking opens on attacker-controlled FIFO paths · New
• Test symlink rejection without modifying the target · New

What changed in this PR

Hardens touch_path() against final-component symlink attacks.

Changes:

• Opens files with O_NOFOLLOW.
• Applies permissions through the file descriptor.
• Converts ELOOP into a security-focused error.

File	Description
gprofiler/​utils/​__init__.py	Implements symlink-safe file creation and permission handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The implementation drops touch timestamp semantics and lacks a focused security regression test.

Review effort: Balanced
Findings: 1

Open (1)

• Test symlink rejection without modifying the target

Resolved since last review (1)

• Prevent blocking opens on attacker-controlled FIFO paths

Previously missed (2)

In code that hasn't changed since last review

Preserve touch timestamp updates for existing regular files

gprofiler/​utils/​__init__.py:398

This no longer performs the “touch” part for an existing regular file: opening it without writing or truncating and then calling fchmod() leaves its access and modification timestamps unchanged. That regresses the previous Path.touch() behavior (and the function’s contract). Update the timestamps through the already-validated descriptor before closing it.

Add regression test rejecting symlinked final output paths

gprofiler/​utils/​__init__.py:390

The existing Java symlink test only exercises symlinks in parent paths; it never places a symlink at the final async-profiler output/log path. Add a focused regression test that makes the final path a symlink, asserts touch_path() rejects it, and verifies the symlink target’s mode is unchanged. Otherwise the security property this PR introduces can regress while the cited tests still pass.