Protect the fallback temporary home directory by enforcing and checking its file mode on Unix platforms (#27985)

src/System.Management.Automation/CoreCLR/CorePsPlatform.cs

@@ -280,7 +280,17 @@ namespace System.Management.Automation
             try
             {
                 s_tempHome = Path.Combine(Path.GetTempPath(), StringUtil.Format(tempHomeFolderName, Environment.UserName));
-                Directory.CreateDirectory(s_tempHome);
+
+                // Create the temporary home directory with the user-only permission.
+                UnixFileMode userOnlyMode = UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute;
+                var dirInfo = Directory.CreateDirectory(s_tempHome, userOnlyMode);
+                if (dirInfo.UnixFileMode != userOnlyMode)
+                {
+                    // The permission is not as expected, which indicates the directory may be pre-created by a different user.
+                    // Throw an exception and fail PowerShell in this case for security reason.
+                    throw new InvalidOperationException(
+                        StringUtil.Format(CoreClrStubResources.TempHomeDirectoryUnsafePermission, s_tempHome));
+                }
             }
             catch (UnauthorizedAccessException)
             {

src/System.Management.Automation/resources/CoreClrStubResources.resx

@@ -138,4 +138,8 @@
   <data name="UnknownErrorNumber" xml:space="preserve">
     <value>Unknown error "{0}".</value>
   </data>
+  <data name="TempHomeDirectoryUnsafePermission" xml:space="preserve">
+    <value>The temporary HOME directory '{0}' already exists but does not have the expected user-only permission. It may have been created by a different user, which is a potential security risk. PowerShell will not start until this directory is removed, its permission is corrected, or the 'HOME' environment variable is set.</value>
+    <comment>{StrContains="HOME"}</comment>
+  </data>
 </root>