From e6090e8d7159cd364a09eec67d7dfc23f11b6e58 Mon Sep 17 00:00:00 2001 From: Jason Villarreal Date: Thu, 16 Jul 2026 11:58:12 -0700 Subject: [PATCH] Preventing the use of JSON files as input if the user is root for security Signed-off-by: Jason Villarreal --- profile/plugin/aie_profile/aie_profile_metadata.cpp | 5 ++++- profile/plugin/aie_trace/aie_trace_metadata.cpp | 7 +++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/profile/plugin/aie_profile/aie_profile_metadata.cpp b/profile/plugin/aie_profile/aie_profile_metadata.cpp index f578a613..817c5e6f 100644 --- a/profile/plugin/aie_profile/aie_profile_metadata.cpp +++ b/profile/plugin/aie_profile/aie_profile_metadata.cpp @@ -67,7 +67,10 @@ namespace xdp { std::string settingFile = xrt_core::config::get_xdp_json(); PluginJsonSetting pluginSettings; - if (!settingFile.empty() && SettingsJsonParser::getInstance().isValidJson(settingFile)) { + // Only check for JSON file as an input if not running as root + if (!xrt_core::utils::is_elevated_process() && + !settingFile.empty() && + SettingsJsonParser::getInstance().isValidJson(settingFile)) { xrt_core::message::send(severity_level::info, "XRT", "Using JSON settings from '" + settingFile + "'"); diff --git a/profile/plugin/aie_trace/aie_trace_metadata.cpp b/profile/plugin/aie_trace/aie_trace_metadata.cpp index 7e052c04..7413b7f5 100644 --- a/profile/plugin/aie_trace/aie_trace_metadata.cpp +++ b/profile/plugin/aie_trace/aie_trace_metadata.cpp @@ -114,8 +114,11 @@ namespace xdp { bool useXdpJson = false; std::string settingFile = xrt_core::config::get_xdp_json(); PluginJsonSetting pluginSettings; - - if (!settingFile.empty() && SettingsJsonParser::getInstance().isValidJson(settingFile)) { + + // Only use the JSON file if we aren't running as root + if (!xrt_core::utils::is_elevated_process() && + !settingFile.empty() && + SettingsJsonParser::getInstance().isValidJson(settingFile)) { xrt_core::message::send(severity_level::info, "XRT", "Using JSON settings from '" + settingFile + "'");