diff --git a/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs b/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs index 4cbb346fb..133412fd8 100644 --- a/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs +++ b/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs @@ -280,7 +280,17 @@ namespace System.Management.Automation try { s_tempHome = Path.Combine(Path.GetTempPath(), StringUtil.Format(tempHomeFolderName, Environment.UserName)); - Directory.CreateDirectory(s_tempHome); + + // Create the temporary home directory with the user-only permission. + UnixFileMode userOnlyMode = UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute; + var dirInfo = Directory.CreateDirectory(s_tempHome, userOnlyMode); + if (dirInfo.UnixFileMode != userOnlyMode) + { + // The permission is not as expected, which indicates the directory may be pre-created by a different user. + // Throw an exception and fail PowerShell in this case for security reason. + throw new InvalidOperationException( + StringUtil.Format(CoreClrStubResources.TempHomeDirectoryUnsafePermission, s_tempHome)); + } } catch (UnauthorizedAccessException) { diff --git a/src/System.Management.Automation/resources/CoreClrStubResources.resx b/src/System.Management.Automation/resources/CoreClrStubResources.resx index 7be2f9081..25eb1f4bf 100644 --- a/src/System.Management.Automation/resources/CoreClrStubResources.resx +++ b/src/System.Management.Automation/resources/CoreClrStubResources.resx @@ -138,4 +138,8 @@ Unknown error "{0}". + + The temporary HOME directory '{0}' already exists but does not have the expected user-only permission. It may have been created by a different user, which is a potential security risk. PowerShell will not start until this directory is removed, its permission is corrected, or the 'HOME' environment variable is set. + {StrContains="HOME"} +