2 ms·

Yes, it does. The attacker knows that snap is going to look in /tmp/.snap/, instead of e.g. /tmp/.snap.FjBz8oEWaU/ (which isn't guessable in advance) so when /t

Yes, it does. The attacker knows that snap is going to look in /tmp/.snap/, instead of e.g. /tmp/.snap.FjBz8oEWaU/ (which isn't guessable in advance) so when /tmp is flushed, he just has to recreate /tmp/.snap/ before snap-confine does, and drop his payload there.

AgentME 8mo ago
If the directory had a random name, the attacker could see that name and recreate it after /tmp is flushed.
- lathiat 8mo ago
  Only if you reuse the same random name. Which would be silly.