The canna systemd service uses a publically accessible directory
/tmp/.iroha_unix for placing a UNIX domain socket in it. The socket is
accessible for all other users in the system.

canna ships a systemd-tmpfiles configuration file to create this directory at
boot time:

/usr/lib/tmpfiles.d/canna-tmpfiles.conf:

```
d /tmp/.iroha_unix 0755 root root -
```

This is necessary, because otherwise arbitrary users in the system could
pre-create this directory as long as cannaserver is not running, and
cannaserver would be using an unsafe directory for placing its socket.

cannaserver itself is attempting to create /tmp/.iroha_unix during startup but
tolerates if the directory already exists. It does not run a sanity check on
the permissions of this directory, however, so it will happily use an unsafe
one. cannaserver does *not* clean up an already existing socket in this
directory, however, it will fail to start instead if the socket already
exists.

The latter was the cause for bug 910933 which has been fixed by changing the
canna.service unit like this:

canna.service:

```
ExecPre=/bin/rm -rf /tmp/.iroha_unix
ExecStart=/usr/sbin/cannaserver -s -u wnn -r /var/lib/canna
ExecStopPost=/bin/rm -rf /tmp/.iroha_unix
```

This counteracts the initial idea of the systemd-tmpfiles configuration,
because now there exist time windows again when /tmp/.iroha_unix is *not*
existing, allowing other local users an attack.

I tested an exploit and it is easily possible to wait for /tmp/.iroha_unix to
be delete via `inotify_wait()` and then create a world-writable directory of
mode 777 but owned by the attacker in its stead. cannaserver will then create
its socket in the unsafe directory, the attacker can delete the socket again
and place its own fake socket there. This means the attacker can intercept
client connections and receive their input data and return back manipulated
data.

I will suggest a fix for this soon. A proper long-term fix is to to change the
directory to /run/canna, there arbitrary users won't be able to stage attacks.
For this the Canna.conf file in the build tree would need to be patched to
change the UnixSockDir setting appropriately.

In this form this is more like a SUSE specific bug. Upstream has no systemd
service files and doesn't seem to suggest any integration for Linux. The
default value for UnixSockDir is a bad one, however. Also there could be more
hardening like sanity checking the socket directory's permissions at startup.