[codex] OM-SEC-11: Confine screen recorder state to a private runtime

[AFOliveira]

Summary

A second local UID could plant the global filename state and make the victim finalizer rewrite an attacker-selected victim-owned media file.

Finding: OM-SEC-11

Security impact

A second local account can redirect finalization onto a victim-owned media file and cause the victim process to overwrite it.

Remediation

State moved to a validated private runtime directory and is locked, atomic, mode 0600, and bound to PID/start time/owner/token/output. Finalization is confined to the configured recording directory.

The reviewed implementation applies these concrete controls:

• All state is inside a validated private runtime directory.
• State publication is locked, atomic, single-record, and mode 0600.
• The recorder identity includes PID, process start time, owner, token, and expected output.
• Finalization stays inside the configured recording directory and refuses stale, malformed, linked, foreign, or swapped state.
• Startup/finalization are bounded and signal cleanup is identity-aware.

Validation

The baseline cross-UID overwrite succeeded; PID reuse, path escape, symlink, malformed state, codec/startup failures, cancellation, concurrency, and signal tests pass.

Detailed regression coverage: screenrecording-security-test.sh plus screenrecording-test.sh cover two-UID poisoning, PID reuse, path escape, symlinks, malformed state, startup timeout, codec failure, cancellation, signals, and normal finalization.

Current status: Fixed.

All changed shell files on this branch pass bash -n, and git diff --check passes.

Coordination

This is one finding in a coordinated 21-finding disclosure sent to the Omarchy security team. The corresponding Markdown report contains the affected-code analysis and safe reproduction.

This branch is independently reviewable against quattro.

[AFOliveira]

Closing this remediation in favor of #8374. I re-reviewed the threat boundary and ran #8374 locally: its complete focused screen-recording suite passes, as do shell syntax and git diff --check. Moving the recording filename, region, and debug state out of shared /tmp closes the reported second-UID poisoning primitive. This branch’s much larger PID/token/media rewrite mainly adds same-UID defenses and is not a better review tradeoff for OM-SEC-11. #8374 predates this branch and should remain the single review target.