Merged
Conversation
Change-Id: Id95df391f74b819b8ae379211b543cc1ab024b01
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Change-Id: Id6c3901fa6488247cecad955ac83ec70ccfe7a6b
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Change-Id: I2b2b8a80fc28aa4386b0ae892de8942fc8a9de16
Change-Id: I06ce53b789c378b52520f777dad1e4e5ad251b20
Linux: -fstack-protector-strong, -z,relro, -z,now, -z,noexecstack Windows: /GS, /Gy, /DYNAMICBASE, /NXCOMPAT, /Qspectre, /W4
Fix 4 HIGH severity command injection vulnerabilities (B602/CWE-78) in pmu-query.py
Usage of LoadLibraryEx function with LOAD_LIBRARY_SEARCH_SYSTEM32 is added
Change-Id: Ib7b72f15a9da50ecda149ed7611e6c076969c369
Add O_NOFOLLOW flags and symlink validation to MSR, PCI, SysFS, and daemon file operations to prevent privilege escalation via symlink redirects.
- daemon.cpp: Use unlink()+open(O_EXCL|O_NOFOLLOW) in setupSharedMemory (CID 8073804) - utils.cpp: Use open(O_NOFOLLOW)+fdopen() in tryOpen (CID 8073803)
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Replace upfront unlink() with atomic O_EXCL attempt first, retry on EEXIST with max 3 attempts to prevent both race conditions and DoS.
- Run Bandit only when Python files or config changes - Exclude submodules from scan - Fail CI on any security issues detected
Change-Id: I9aa1c7c47d5755255026579e88182030f0798523
Change-Id: I883bf8ae288e2d1fda359eff0f4ce4f39901dba5
opcm
approved these changes
Jan 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.