Bug 287654

Summary:	/var/tmp/kdecache security concern
Product:	[I don't know] kde	Reporter:	Mikiya Okuno <mikiya.okuno>
Component:	general	Assignee:	Unassigned bugs mailing-list <unassigned-bugs>
Status:	RESOLVED FIXED
Severity:	wishlist	CC:	cfeck, faure, mikiya.okuno, nate
Priority:	NOR
Version:	unspecified
Target Milestone:	---
Platform:	Ubuntu
OS:	Linux
Latest Commit:		Version Fixed In:
Sentry Crash Report:

Description Mikiya Okuno 2011-11-27 02:35:36 UTC

Version:           unspecified (using KDE 4.7.2) 
OS:                Linux

Currently, some cache files are created under /var/tmp/kdecache-USER directory. Recently, many users encrypt their home directory for security. However, creating user files other than their own home directory may exploit user's private data. Without encryption, data can be read when the PC is stolen.

IMHO, /var/tmp/kdecache-USER/http looks risky, because user's browsing history would be leaked. In order to secure the system in the future, I suggest to move whole kdecache directory under the user's home directory. e.g. $HOME/.kde/cache

Currently, I have to mount an encrypted file system to /var/tmp to secure my KDE desktop.

Reproducible: Didn't try

Steps to Reproduce:
nada

Actual Results:  
nada

Expected Results:  
nada

I also recommend to encrypt /tmp directory of course.

Comment 1 Christoph Feck 2011-11-28 14:18:16 UTC

The reason the cached files are not in home directory is because a remote home would be way slower, so a local cache directory is used. To change that behavior, you can change the links in .kde

http://techbase.kde.org/KDE_System_Administration/KDE_Filesystem_Hierarchy

Comment 2 Mikiya Okuno 2011-11-28 15:41:03 UTC

Hi Christoph,

Thank you for your comment. The KDEVARTMP could be a good solution here. I'd like to have a UI in "System Settings" GUI.

Comment 3 David Faure 2013-12-18 14:22:10 UTC

Alternative solution: the symlinks under ~/.kde can be replaced with real dirs, and then /var won't be used.

This isn't a security issue in any case, but at most a privacy issue, and even that is dubious, given the permissions on the directory.

Comment 4 Nate Graham 2020-09-29 20:50:55 UTC

Which KDE apps are doing this?

Comment 5 David Faure 2020-10-11 18:37:50 UTC

None, anymore. This was the kde4 setup.

Qt5 changed this with ~/.cache as default.