rpcd, branch master

session: stop naming runtime files after the session id

2026-10-03T23:54:11Z

rpcd names the uci delta directory /var/run/rpcd/uci- and the frozen session file /var/run/rpcd/sessions/ after the raw session id, which is a bearer credential. The file plugin lists directories as root and only checks the "list" permission, and ACL paths are matched with fnmatch() without FNM_PATHNAME, so the "/*" grant of luci-base covers /var/run/rpcd. A restricted login can read a privileged session's token from a directory entry and replay it. A default installation is not affected, as its only login is root. Give each session a separate random name, generated in rpc_session_new(), and build both paths from it. rpcd does not purge the delta directories on reload, so rpc_session_thaw() restores the name from the frozen file's name to keep the staged changes. Files frozen by an older rpcd are named after the session id, which also matches their delta directory. Reported-by: kiperZZZ Fixes: b3a5c08e087b ("uci: use per-session save directory and register session destroy callback to purge leftover deltas") Fixes: aa2afdb739b4 ("session: add support for saving and restoring session data to disk") Assisted-by: Claude:claude-opus-5 Link: https://github.com/openwrt/rpcd/pull/43 Signed-off-by: Hauke Mehrtens

ucode: add compatibility to newer ucode version

2026-09-25T11:12:43Z

It adds STATUS_BREAK for breakpoints. Add a default switch/case fallback to avoid running into the unhandled case warning/error. Signed-off-by: Felix Fietkau

file: reply with empty data instead of error for empty files

2026-09-17T13:52:51Z

read() returns 0 for an empty file (st_size 0, e.g. right after touch), which previously hit the <= 0 check and replied UBUS_STATUS_NO_DATA (5), so 'ubus call file read' on an empty file failed with 'No response'. Treat a zero-byte read as a successful empty reply: only actual read errors (< 0) map to UBUS_STATUS_NO_DATA, while a zero-length read (0) replies { "data": "" } with status 0. Fixes #42 Signed-off-by: Jo-Philipp Wich

file: re-authorize ACL against resolved path to close symlink bypass

2026-07-19T12:57:18Z

The file plugin matched ACL grants against the textual, canonicalized path but then let open()/stat()/opendir() follow symlinks unchecked. A symlink placed inside an ACL-covered directory therefore let a grant on the link authorize read/write/list/stat access to whatever file it pointed to, including files entirely outside the granted scope. Re-resolve the path with realpath() and re-run the ACL check against the resolved target whenever it differs from the canonicalized string, for every operation that dereferences the final component (read, write, md5, list, stat). lstat and remove are left untouched since they either need to see the link itself or already handle it safely via unlink()'s no-follow semantics. Newly created files (file.write) and dangling symlinks pointing outside the granted scope are handled via the containing directory. Also mask file.write's mode parameter to 0777 and drop the local umask(0) override, and authorize recursive file.remove per-entry instead of only at the top-level path. Fixes GHSA-q5gr-86pq-vvwr. Signed-off-by: Jo-Philipp Wich

cast char arguments to unsigned char for ctype.h functions

2026-06-03T23:20:50Z

isspace()/isxdigit()/isalnum()/tolower() are only defined for arguments representable as unsigned char or EOF. Several call sites passed a plain (signed) char taken from client- or file-controlled data (uci names, the session id, apk db lines, ACL list entries); a byte >= 0x80 sign-extends to a negative int, which is undefined behaviour and can index out of bounds of a ctype lookup table on some C libraries. Cast the argument to unsigned char at each site. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

iwinfo: fix error handling and backend leak in survey

2026-06-03T23:20:46Z

rpc_iwinfo_survey() opened the iwinfo backend and the "results" blob array, then on any error (open failed, survey call failed, negative length) did "return UBUS_STATUS_OK" without sending a reply and without calling rpc_iwinfo_close(). That leaked the iwinfo backend until the next iwinfo call, abandoned a half-built reply, and masked an open failure as success. Restructure it like the freqlist/txpowerlist/countrylist handlers: return the open error directly, otherwise emit the (possibly empty) results array, send the reply and always release the backend. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

ucode: bound recursion when converting blob arguments to ucode values

2026-06-03T23:20:41Z

rpc_ucode_blob_array_to_ucv()/rpc_ucode_blob_to_ucv() recurse once per nesting level of the incoming request message, which is fully attacker controlled. ubus permits messages up to UBUS_MAX_MSGLEN (1 MiB) and libubox enforces no nesting limit, so a deeply nested array/table argument to a ucode plugin method can drive tens of thousands of recursion levels and overflow the stack, crashing rpcd. Thread a depth counter through the conversion and stop descending past RPC_UCODE_MAX_NESTING (32) levels, which is far beyond any legitimate ubus message. Over-deep subtrees become null values instead of crashing. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

file: avoid zero-length b64_decode() on empty write data

2026-06-03T23:20:36Z

rpc_file_write() computes data_len as blobmsg_data_len() - 1, which is 0 for an empty "data" string. With base64 enabled it then called b64_decode(data, data, 0); b64_decode() asserts dest size > 0, so a request like file.write {"data":"","base64":true} aborts the daemon when libubox is built with assertions enabled (and is a pointless call otherwise). Skip the decode when there is no data; the file is still created/ truncated and zero bytes are written, which is the correct result. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS

2026-06-03T23:20:31Z

The /etc/apk/world parser depends on a NUL byte one past the file contents (world buffer is sized st_size + 1) to terminate its string scans, and the world[] pointer walk and is_all_or_world() dereference a sentinel that points at that trailing byte. The file was mapped with mmap(st_size + 1); when the file size is an exact multiple of the page size, the byte at offset st_size lies in a page entirely beyond EOF and accessing it raises SIGBUS, crashing the daemon. Read the file into a malloc'd buffer and NUL terminate it explicitly so the terminator is always backed by real memory. This also drops the now unused include. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

rpc-sys: packagelist: close status file on world parsing error paths

2026-06-03T23:20:26Z

rpc_sys_packagelist() opens /lib/apk/db/installed and then, for the non-"all" case, opens and parses /etc/apk/world. Every early error return in that parsing block (missing world file, fstat failure, empty or newline-less world, mmap failure) returned without fclose()ing the already open status file, leaking a FILE/descriptor on each call. The most easily triggered case is a system whose installed db exists but that has no /etc/apk/world. Close the status file on all of these error paths. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens