Fix security vulnerability: restore ownership validation in mkdir_owned_root

[mlim19]

Summary

• Remove erroneous unconditional return statement in mkdir_owned_root() that made ownership validation unreachable (dead code)
• Restores the security check that ensures temp directories are root-owned before use

Background

Commit 5285bef7 ("Support java profiling without root privilege in a container #987") accidentally introduced an unconditional return statement that bypassed the ownership validation logic:

if path.exists():
    return                                    # <- BUG: makes code below unreachable
    if is_root() and is_owned_by_root(path):  # <- Dead code
        return
    shutil.rmtree(path)                       # <- Never executed

This regression created a local privilege escalation vulnerability where a low-privilege attacker could pre-create /tmp/gprofiler_tmp before gProfiler runs as root. The ownership check that should remove and recreate non-root-owned directories was bypassed.

Test plan

• Verify mkdir_owned_root() removes non-root-owned directories when running as root
• Run existing unit tests
• Manual test: create /tmp/gprofiler_tmp as non-root user, run gProfiler as root, verify directory is recreated as root-owned

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This pull request removes an unintended early return in mkdir_owned_root() so that root ownership validation is no longer unreachable, restoring the intended protection against using attacker-precreated temp directories when running as root.

Changes:

• Removed an unconditional return that made ownership validation dead code in mkdir_owned_root().

Comments suppressed due to low confidence (1)

gprofiler/utils/fs.py:126

• mkdir_owned_root() currently treats any existing path as a candidate directory and (after this change) will rmtree() it whenever is_root() is false, which can break rootless runs (e.g. Java profiler __enter__ calls this even when not root). Also, the ownership checks use Path.stat() (follows symlinks), so a user-controlled symlink to a root-owned directory can bypass the validation and later cause writes into an unintended location. Consider handling non-root as a non-destructive “ensure exists & writable” path and explicitly rejecting/removing symlinks/non-directories when running as root.

    if path.exists():
        if is_root() and is_owned_by_root(path):
            return

        shutil.rmtree(path)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dkorlovs]

@mlim19 do we go through this flow in case of " java profiling without root privilege"? If yes, then correct way to implement it, is to check that user who run gprofiler and owner of directory are the same, i.e. check not only root.