It's only a security issue if your system is already compromised.
so should it be a security issue the system does not need to be compromised.
linux is a multiuser system and /tmp is shared between all users by default
While /tmp is shared, what sort of data is in the file?
Moreover, they're in /tmp. When you close Steam, are they still there?
I don't really understand what these FIFOs are there for, but if they pose "a security issue if your system is already compromised", I'd rather they had way more restrictive permissions. Security is all about assuming that the system is already compromised and limiting the damages, isn't it? So as long as those 775 permissions aren't required for the program to operate, they should really be 700.
@JLimperg they can also pose a problem in a multiuser environment... if you have more then one user account on the computer other users can ssh into your computer and view the files... the computer itself does not have to be compromised. This is most likely to be exploited (if there is anything to exploit) on public computers such as the ones in my University rather then your home computer.
I've checked the files more thoroughly.
No security threat; they're FIFOs alright.
http://linux.die.net/man/7/fifo
By username, it's the system's username, not your Steam login. As such, mine is /tmp/josh-steam-mstr-cs and /tmp/josh-steam-mstr-sc
yes I checked with strace they are created with mknod which is symlink safe, so its that particular security issue is of no concern.
but do they really need world write permissions?
fifos should probably be in $XDG_RUNTIME_DIR if available (which is only in newer distributions unfortunately)
Also, Steam creates /tmp/dumps directory, which seems not to be multi-user aware and therefore shared between users.
IMO it'd make more sense to me if the temp files/dirs are named with "steam-blahblah-username", or better, all in one directory (since there is more of them), like this (for user foo):
/tmp/steam-foo/
/tmp/steam-foo/mstr-cs
/tmp/steam-foo/mstr-sc
/tmp/steam-foo/dumps/
Note that this is the way other sw names and uses its temp dirs, e.g. kde (/tmp/kde-foo), ksocket (/tmp/ksocket-foo), orbit (/tmp/orbit-foo), tracker (/tmp/tracker-foo), pulseaudio (which uses /tmp/pulse-somerandommess) and ssh (also /tmp/ssh-somerandommess) - these are only examples of those I have running.
Also, all of these have permissions 0700 (unlike steam temp files which have 0755).
Nothing extracted yet.
steam creates file with a predictable name in /tmp
/tmp/username-steam-mstr-sc
/tmp/username-steam-mstr-cs
with global read write permissions.
if both names are already taken the application spits out lots of error messages but seems to still be working:
Unknown internal error occurred - Invalid client connect
this is in the worst case this could also be a security issue.