The directory where the shared-memory state files (.shm_state) are stored is hard-coded at compile time and points to a system-wide directory shared by all users. On Windows it is C:\Temp\ (through TEMP_DIRECTORY).
As a result, two processes started by two different Windows users write their .shm_state files to the same C:\Temp\ directory. The file names depend only on the shared-memory segment name, so different users collide, can see each other's state files, and one user can break another user's shared-memory segment.
Expected behavior
.shm_state files should be stored in a per-user directory by default:
Windows: %APPDATA%\iceoryx2\shm
Unix/macOS: $XDG_STATE_HOME/iceoryx2/shm/ or $HOME/.local/state/iceoryx2/shm/
The directory should be configurable at runtime without recompiling or patching the crate.
Root cause
iceoryx2-pal-posix/src/windows/settings.rs:
pub(crate) const SHM_STATE_DIRECTORY: &[u8] = iceoryx2_pal_configuration::TEMP_DIRECTORY;
- iceoryx2-pal-configuration (Windows): TEMP_DIRECTORY = C:\Temp\
- iceoryx2-pal-posix/src/windows/mman.rs builds the state-file path at runtime (shm_file_path), but the base directory is frozen at compile time.
- The high-level iceoryx2.toml [global] root-path only controls the service/node directories, not the .shm_state directory, so users cannot work around this by configuration.
The same pattern exists in macos/settings.rs and freebsd/settings.rs (using /tmp). Linux/NTO are not affected because they do not use SHM_STATE_DIRECTORY
Steps to reproduce
- On Windows, as user A, start an iceoryx2 application that creates a shared-memory segment.
- As user B (different account, same machine), can access/delete file of other user.
- Observe that both processes create/access the same C:\Temp<name>.shm_state.
Suggested fix
Simple : runtime resolution + environment variable
Replace the compile-time SHM_STATE_DIRECTORY constant with a runtime-resolved value (e.g., a lazily-initialized std::sync::OnceLock<Vec>) on the std platforms (Windows/macOS/FreeBSD), with the following resolution order:
- IOX2_SHM_STATE_DIRECTORY environment variable (explicit override) for custom path;
- per-user default (%APPDATA%\iceoryx2\shm\ on Windows, $HOME/.local/state/iceoryx2/shm/ elsewhere);
- fallback to the current TEMP_DIRECTORY.
complete: TOML configuration
Add a dedicated section to the high-level configuration so users can set the state directory in iceoryx2.toml, consistently with the existing root-path mechanism.
This is a larger API change, but it provides the cleanest user-facing experience and mirrors how root-path already works.
The directory where the shared-memory state files (.shm_state) are stored is hard-coded at compile time and points to a system-wide directory shared by all users. On Windows it is C:\Temp\ (through TEMP_DIRECTORY).
As a result, two processes started by two different Windows users write their .shm_state files to the same C:\Temp\ directory. The file names depend only on the shared-memory segment name, so different users collide, can see each other's state files, and one user can break another user's shared-memory segment.
Expected behavior
.shm_state files should be stored in a per-user directory by default:
Windows: %APPDATA%\iceoryx2\shm
Unix/macOS: $XDG_STATE_HOME/iceoryx2/shm/ or $HOME/.local/state/iceoryx2/shm/
The directory should be configurable at runtime without recompiling or patching the crate.
Root cause
iceoryx2-pal-posix/src/windows/settings.rs:
pub(crate) const SHM_STATE_DIRECTORY: &[u8] = iceoryx2_pal_configuration::TEMP_DIRECTORY;
The same pattern exists in macos/settings.rs and freebsd/settings.rs (using /tmp). Linux/NTO are not affected because they do not use SHM_STATE_DIRECTORY
Steps to reproduce
Suggested fix
Simple : runtime resolution + environment variable
Replace the compile-time SHM_STATE_DIRECTORY constant with a runtime-resolved value (e.g., a lazily-initialized std::sync::OnceLock<Vec>) on the std platforms (Windows/macOS/FreeBSD), with the following resolution order:
complete: TOML configuration
Add a dedicated section to the high-level configuration so users can set the state directory in iceoryx2.toml, consistently with the existing root-path mechanism.
This is a larger API change, but it provides the cleanest user-facing experience and mirrors how root-path already works.