Store .lock/.socket files in XDG_RUNTIME_DIR

[jamessan]

keepassxc/src/gui/Application.cpp

Lines 80 to 82 in 5de669e

	// According to documentation we should use RuntimeLocation on *nixes, but even Qt doesn't respect
	// this and creates sockets in TempLocation, so let's be consistent.
	m_lockFile = new QLockFile(QStandardPaths::writableLocation(QStandardPaths::TempLocation) + "/" + lockName);

Given that /tmp may be periodically cleaned during the uptime of a system, it seems like these should live under $XDG_RUNTIME_DIR.

[droidmonkey]

we'll consider that when we move to Qt6

[HanabishiRecca]

A more pronounced issue here that there could be more than 1 user in the system. If they open the app simultaneously... well, it will be a mess.

Also, /tmp is world-readable, which is not really good for security.

[droidmonkey]

Yes good points, although there is nothing sensitive in this lock file except for its mere presence.

[jamessan]

A more pronounced issue here that there could be more than 1 user in the system. If they open the app simultaneously... well, it will be a mess.

Not really, since the username is part of the filename --

keepassxc/src/gui/Application.cpp

Lines 65 to 68 in 5de669e

	QString userName = qgetenv("USER");
	if (userName.isEmpty()) {
	userName = qgetenv("USERNAME");
	}

[droidmonkey]

Yes that is also true

[HanabishiRecca]

Yeah, I didn't notice that. Sorry, disregard my gripes then.

Although, it'd better be a user id instead. But using XDG_RUNTIME_DIR is the best solution anyway.