nac_test/pyats_core/broker/connection_broker.py:117-131 creates the Unix socket via asyncio.start_unix_server (uses process umask), then applies os.chmod(path, 0o600). Between those two calls there's a narrow window during which another local UID on a shared host with a wide umask could connect() and issue arbitrary CLI on any device in the loaded testbed (broker IPC is filesystem-perm-gated, no bearer token).
Fix: Create the socket inside a mkdtemp(mode=0o700) parent dir and place the socket inside it, or set umask(0o077) immediately before start_unix_server and restore afterwards. Low priority — only affects shared-user Linux hosts with wide umasks.
nac_test/pyats_core/broker/connection_broker.py:117-131creates the Unix socket viaasyncio.start_unix_server(uses process umask), then appliesos.chmod(path, 0o600). Between those two calls there's a narrow window during which another local UID on a shared host with a wide umask couldconnect()and issue arbitrary CLI on any device in the loaded testbed (broker IPC is filesystem-perm-gated, no bearer token).Fix: Create the socket inside a
mkdtemp(mode=0o700)parent dir and place the socket inside it, or setumask(0o077)immediately beforestart_unix_serverand restore afterwards. Low priority — only affects shared-user Linux hosts with wide umasks.