diff --git a/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs b/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs
index 4cbb346fb..133412fd8 100644
--- a/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs
+++ b/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs
@@ -280,7 +280,17 @@ namespace System.Management.Automation
try
{
s_tempHome = Path.Combine(Path.GetTempPath(), StringUtil.Format(tempHomeFolderName, Environment.UserName));
- Directory.CreateDirectory(s_tempHome);
+
+ // Create the temporary home directory with the user-only permission.
+ UnixFileMode userOnlyMode = UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute;
+ var dirInfo = Directory.CreateDirectory(s_tempHome, userOnlyMode);
+ if (dirInfo.UnixFileMode != userOnlyMode)
+ {
+ // The permission is not as expected, which indicates the directory may be pre-created by a different user.
+ // Throw an exception and fail PowerShell in this case for security reason.
+ throw new InvalidOperationException(
+ StringUtil.Format(CoreClrStubResources.TempHomeDirectoryUnsafePermission, s_tempHome));
+ }
}
catch (UnauthorizedAccessException)
{
diff --git a/src/System.Management.Automation/resources/CoreClrStubResources.resx b/src/System.Management.Automation/resources/CoreClrStubResources.resx
index 7be2f9081..25eb1f4bf 100644
--- a/src/System.Management.Automation/resources/CoreClrStubResources.resx
+++ b/src/System.Management.Automation/resources/CoreClrStubResources.resx
@@ -138,4 +138,8 @@
Unknown error "{0}".
+
+ The temporary HOME directory '{0}' already exists but does not have the expected user-only permission. It may have been created by a different user, which is a potential security risk. PowerShell will not start until this directory is removed, its permission is corrected, or the 'HOME' environment variable is set.
+ {StrContains="HOME"}
+