Skip to content

SHM_STATE_DIRECTORY is a compile-time constant, preventing per-user isolation on Windows/macOS/FreeBSD #1951

Description

@max3163

The directory where the shared-memory state files (.shm_state) are stored is hard-coded at compile time and points to a system-wide directory shared by all users. On Windows it is C:\Temp\ (through TEMP_DIRECTORY).

As a result, two processes started by two different Windows users write their .shm_state files to the same C:\Temp\ directory. The file names depend only on the shared-memory segment name, so different users collide, can see each other's state files, and one user can break another user's shared-memory segment.

Expected behavior

.shm_state files should be stored in a per-user directory by default:
Windows: %APPDATA%\iceoryx2\shm
Unix/macOS: $XDG_STATE_HOME/iceoryx2/shm/ or $HOME/.local/state/iceoryx2/shm/
The directory should be configurable at runtime without recompiling or patching the crate.

Root cause

iceoryx2-pal-posix/src/windows/settings.rs:
pub(crate) const SHM_STATE_DIRECTORY: &[u8] = iceoryx2_pal_configuration::TEMP_DIRECTORY;

  • iceoryx2-pal-configuration (Windows): TEMP_DIRECTORY = C:\Temp\
  • iceoryx2-pal-posix/src/windows/mman.rs builds the state-file path at runtime (shm_file_path), but the base directory is frozen at compile time.
  • The high-level iceoryx2.toml [global] root-path only controls the service/node directories, not the .shm_state directory, so users cannot work around this by configuration.

The same pattern exists in macos/settings.rs and freebsd/settings.rs (using /tmp). Linux/NTO are not affected because they do not use SHM_STATE_DIRECTORY

Steps to reproduce

  1. On Windows, as user A, start an iceoryx2 application that creates a shared-memory segment.
  2. As user B (different account, same machine), can access/delete file of other user.
  3. Observe that both processes create/access the same C:\Temp<name>.shm_state.

Suggested fix

Simple : runtime resolution + environment variable
Replace the compile-time SHM_STATE_DIRECTORY constant with a runtime-resolved value (e.g., a lazily-initialized std::sync::OnceLock<Vec>) on the std platforms (Windows/macOS/FreeBSD), with the following resolution order:

  1. IOX2_SHM_STATE_DIRECTORY environment variable (explicit override) for custom path;
  2. per-user default (%APPDATA%\iceoryx2\shm\ on Windows, $HOME/.local/state/iceoryx2/shm/ elsewhere);
  3. fallback to the current TEMP_DIRECTORY.

complete: TOML configuration

Add a dedicated section to the high-level configuration so users can set the state directory in iceoryx2.toml, consistently with the existing root-path mechanism.

This is a larger API change, but it provides the cleanest user-facing experience and mirrors how root-path already works.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions