hitoshura25/cvefixes huggingface dataset:
CVE-2022-23949 (Python, published 2022-09-21T19:15Z)
Description: value: In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/keylime/keylime
Files changed:
keylime/common/validators.py
test/test_validators.py
Commit message: validators: add uuid and agent_id validators

Add valid_uuid and valid_agent_id validators, and tests for both.

Signed-off-by: Alberto Planas <aplanas@suse.com>


Vulnerable code:

Fixed code:


def valid_uuid(uuid: str) -> bool:
    """Check if the string is a valid UUID."""
    valid = False
    try:
        valid = bool(
            re.fullmatch(
                r"[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}",
                uuid,
                re.I,
            )
        )
    except Exception:
        pass
    return valid


def valid_agent_id(agent_id: str) -> bool:
    """Check if agent_id is valid."""
    valid = False
    try:
        valid = bool(re.fullmatch(r"[\w.-]+", agent_id))
    except Exception:
        pass
    return valid
class TestValidUUID(unittest.TestCase):
    """Tests for valid_uuid."""

    def test_none(self):
        """Check that None is not valid."""
        self.assertFalse(validators.valid_uuid(None))

    def test_empty(self):
        """Check that the empty string is not valid."""
        self.assertFalse(validators.valid_uuid(""))

    def test_valid(self):
        """Check a valid UUID that mix upper and lower case."""
        self.assertTrue(validators.valid_uuid("74a93e15-da24-4ff1-ABC0-55beed02a16a"))

    def test_invalid(self):
        """Check an invalid UUID that mix upper and lower case."""
        self.assertFalse(validators.valid_uuid("some text"))


class TestValidAgentID(unittest.TestCase):
    """Tests for valid_agent_id."""

    def test_none(self):
        """Check that None is not valid."""
        self.assertFalse(validators.valid_agent_id(None))

    def test_empty(self):
        """Check that the empty string is not valid."""
        self.assertFalse(validators.valid_agent_id(""))

    def test_valid_uuid(self):
        """Check a valid UUID that mix upper and lower case."""
        self.assertTrue(validators.valid_agent_id("74a93e15-da24-4ff1-ABC0-55beed02a16a"))

    def test_valid_hostname(self):
        """Check a valid hostname that mix upper and lower case."""
        self.assertTrue(validators.valid_agent_id("my-Hostname.example.com"))

    def test_invalid(self):
        """Check an invalid user ID with non valid characters."""
        self.assertFalse(validators.valid_agent_id("rm -fr *"))
CVE-2022-23950 (Python, published 2022-09-21T19:15Z)
Description: value: In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/keylime/keylime
Files changed:
keylime/revocation_notifier.py
Commit message: revocation_notifier: move zmq socket to /var/run/keylime

Currently we are placing the zmq IPC socket in /tmp, that can be
accessed by all the users.

This patch moves the socket into /var/run/keylime, making sure that the
directory is created and present with the correct user permissions.

Signed-off-by: Alberto Planas <aplanas@suse.com>


Vulnerable code:
        frontend.bind("ipc:///tmp/keylime.verifier.ipc")
        if os.path.exists("/tmp/keylime.verifier.ipc"):
            os.remove("/tmp/keylime.verifier.ipc")
        mysock.connect("ipc:///tmp/keylime.verifier.ipc")

Fixed code:
_SOCKET_PATH = "/var/run/keylime/keylime.verifier.ipc"

        dir_name = os.path.dirname(_SOCKET_PATH)
        if not os.path.exists(dir_name):
            os.makedirs(dir_name, 0o700)
        else:
            if os.stat(_SOCKET_PATH).st_mode & 0o777 != 0o700:
                msg = f"{_SOCKET_PATH} present with wrong permissions"
                logger.error(msg)
                raise Exception(msg)

        frontend.bind(f"ipc://{_SOCKET_PATH}")
        if os.path.exists(f"ipc://{_SOCKET_PATH}"):
            os.remove(f"ipc://{_SOCKET_PATH}")
        mysock.connect(f"ipc://{_SOCKET_PATH}")
CVE-2022-23952 (Shell, published 2022-09-21T19:15Z)
Description: value: In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/keylime/keylime
Files changed:
installer.sh
Commit message: Explicitly set permissions on new keylime.conf files installed

Signed-off-by: Michael Peters <mpeters@redhat.com>


Vulnerable code:

Fixed code:
        chmod 600 /etc/keylime.conf.new
    chmod 600 /etc/keylime.conf
CVE-2023-3674 (Python, published 2023-07-19T19:15Z)
Description: value: A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
Severity: nan (CVSS v3 base score: 2.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/keylime/keylime
Files changed:
keylime/tpm/tpm_util.py
keylime/tpm/tpm_util_test.py
Commit message: tpm_util: Replace a logger.error with an Exception in case of invalid signature

This fixes a possibly severe issue in 7.2.5 & 7.3.0.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>


Vulnerable code:
from cryptography.exceptions import InvalidSignature
    try:
        verify(pubkey, signature, quote_digest, hashfunc)
    except InvalidSignature:
        logger.error("Invalid quote signature!")

Fixed code:
    verify(pubkey, signature, quote_digest, hashfunc)
from cryptography.exceptions import InvalidSignature
        # test bad input
        bad_quoteblob = bytearray(quoteblob)
        bad_quoteblob[5] ^= 0x1
        with self.assertRaises(InvalidSignature):
            checkquote(aikblob, nonce, sigblob, bad_quoteblob, pcrblob, "sha256")

        l = list(nonce)
        l[0] = "a"
        bad_nonce = "".join(l)
        with self.assertRaises(Exception):
            checkquote(aikblob, bad_nonce, sigblob, quoteblob, pcrblob, "sha256")

        bad_pcrblob = bytearray(pcrblob)
        bad_pcrblob[5] ^= 0x1
        with self.assertRaises(Exception):
            checkquote(aikblob, nonce, sigblob, quoteblob, bad_pcrblob, "sha256")

        with self.assertRaises(ValueError):
            checkquote(aikblob, nonce, sigblob, quoteblob, pcrblob, "sha1")
CVE-2023-38201 (Python, published 2023-08-25T17:15Z)
Description: value: A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/keylime/keylime
Files changed:
keylime/registrar_common.py
Commit message: Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)

In addition to remove the offending message, this patch also ensures
deletion of an agent's record from the database in case of failure after
a single attempt.

Signed-off-by: Marcio Silva <marcio.a.silva@ibm.com>


Vulnerable code:
                    logger.warning("Contact port for agent %s is not a number between 1 and got: %s.", agent_id, port)
                raise Exception(f"Auth tag {auth_tag} does not match expected value {ex_mac}")

Fixed code:
                    logger.warning(
                        "Contact port for agent %s is not a number between 1 and 65535 got: %s.", agent_id, port
                    )
                if agent_id and session.query(RegistrarMain).filter_by(agent_id=agent_id).delete():
                    try:
                        session.commit()
                    except SQLAlchemyError as e:
                        logger.error("SQLAlchemy Error: %s", e)
                        raise

                raise Exception(
                    f"Auth tag {auth_tag} for agent {agent_id} does not match expected value. The agent has been deleted from database, and a restart of it will be required"
                )
CVE-2022-3506 (PHP, published 2022-10-14T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/barrykooij/related-posts-for-wp
Files changed:
classes/settings/class-settings.php
Commit message: Escape output in setting fields, fixes XSS CWE-79. Props @und3sc0n0c1d0


Vulnerable code:
				echo '<input type="text" name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '" value="' . $this->get_option( $field['id'] ) . '" class="rp4wp-input-text" />';
				echo '<textarea name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '">' . $this->get_option( $field['id'] ) . '</textarea>';
				echo '<a href="' . $field['href'] . '" class="button">' . $field['default'] . '</a>';
}

Fixed code:
				echo '<input type="text" name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '" value="' . esc_attr( $this->get_option( $field['id'] ) ) . '" class="rp4wp-input-text" />';
				echo '<textarea name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '">' . esc_html( $this->get_option( $field['id'] ) ) . '</textarea>';
				echo '<a href="' . esc_attr( $field['href'] ) . '" class="button">' . esc_html( $field['default'] ) . '</a>';
}
CVE-2022-24863 (Go, published 2022-04-18T19:15Z)
Description: value: http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/swaggo/http-swagger
Files changed:
.github/workflows/ci.yml
swagger.go
swagger_test.go
Commit message: fix: security improvement (#62)



Vulnerable code:
        go: [ '1.15.x', '1.16.x', '1.17.x' ]
			http.Redirect(w, r, h.Prefix+"index.html", 301)
	w1 := performRequest("GET", "/index.html", router)
	assert.Equal(t, 200, w1.Code)
	w2 := performRequest("GET", "/doc.json", router)
	assert.Equal(t, 500, w2.Code)
	w2 = performRequest("GET", "/doc.json", router)
	assert.Equal(t, 200, w2.Code)
	w3 := performRequest("GET", "/favicon-16x16.png", router)
	assert.Equal(t, 200, w3.Code)
	w4 := performRequest("GET", "/swagger-ui.css", router)
	assert.Equal(t, 200, w4.Code)
	w5 := performRequest("GET", "/swagger-ui-bundle.js", router)
	assert.Equal(t, 200, w5.Code)
	w6 := performRequest("GET", "/notfound", router)
	assert.Equal(t, 404, w6.Code)
	w7 := performRequest("GET", "/", router)
	assert.Equal(t, 301, w7.Code)

Fixed code:
        go: [ '1.15.x', '1.16.x', '1.17.x', '1.18.x' ]
		if r.Method != http.MethodGet {
			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
			return
		}
			http.Redirect(w, r, h.Prefix+"index.html", http.StatusMovedPermanently)
	w1 := performRequest(http.MethodGet, "/index.html", router)
	assert.Equal(t, http.StatusOK, w1.Code)
	assert.Equal(t, http.StatusInternalServerError, performRequest(http.MethodGet, "/doc.json", router).Code)
	w2 := performRequest(http.MethodGet, "/doc.json", router)
	assert.Equal(t, http.StatusOK, w2.Code)
	w3 := performRequest(http.MethodGet, "/favicon-16x16.png", router)
	assert.Equal(t, http.StatusOK, w3.Code)
	w4 := performRequest(http.MethodGet, "/swagger-ui.css", router)
	assert.Equal(t, http.StatusOK, w4.Code)
	w5 := performRequest(http.MethodGet, "/swagger-ui-bundle.js", router)
	assert.Equal(t, http.StatusOK, w5.Code)
	assert.Equal(t, http.StatusNotFound, performRequest(http.MethodGet, "/notfound", router).Code)
	assert.Equal(t, 301, performRequest(http.MethodGet, "/", router).Code)

	assert.Equal(t, http.StatusMethodNotAllowed, performRequest(http.MethodPost, "/swagger/index.html", router).Code)

	assert.Equal(t, http.StatusMethodNotAllowed, performRequest(http.MethodPut, "/swagger/index.html", router).Code)
CVE-2017-20183 (PHP, published 2023-05-05T01:15Z)
Description: value: A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of the argument url/error/width/height/mime-type leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The patch is identified as 9d2ecd159a6e2e3f710b4f1c28e2714f66502746. It is recommended to upgrade the affected component. VDB-227950 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zzxiang/external-media-without-import
Files changed:
external-media-without-import.php
Commit message: Fixed XSS Security Vulnerabilities and bug with mime types including '+'.

See also: http://php.net/urldecode#refsect1-function.urldecode-notes

git-svn-id: https://plugins.svn.wordpress.org/external-media-without-import/trunk@1746853 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
		  <input id="emwi-url" name="url" type="url" required placeholder="<?php echo __('Image URL');?>" value="<?php echo urldecode( $_GET['url'] ); ?>">
		  <span id="emwi-error"><?php echo urldecode( $_GET['error'] ); ?></span>
		  <input id="emwi-width" name="width" type="number" value="<?php echo urldecode( $_GET['width'] ); ?>">
		  <input id="emwi-height" name="height" type="number" value="<?php echo urldecode( $_GET['height'] ); ?>">
		  <input id="emwi-mime-type" name="mime-type" type="text" value="<?php echo urldecode( $_GET['mime-type'] ); ?>">

Fixed code:
		  <input id="emwi-url" name="url" type="url" required placeholder="<?php echo __('Image URL');?>" value="<?php echo esc_url( $_GET['url'] ); ?>">
		  <span id="emwi-error"><?php echo esc_html( $_GET['error'] ); ?></span>
		  <input id="emwi-width" name="width" type="number" value="<?php echo esc_html( $_GET['width'] ); ?>">
		  <input id="emwi-height" name="height" type="number" value="<?php echo esc_html( $_GET['height'] ); ?>">
		  <input id="emwi-mime-type" name="mime-type" type="text" value="<?php echo esc_html( $_GET['mime-type'] ); ?>">
CVE-2017-7271 (Markdown, published 2017-03-27T17:59Z)
Description: value: Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yiisoft/yii2
Files changed:
framework/CHANGELOG.md
framework/web/ErrorHandler.php
Commit message: Fixes #13401: Fixed lack of escaping of request dump at exception screens



Vulnerable code:

        return '<pre>' . rtrim($request, "\n") . '</pre>';

Fixed code:
- Bug #13401: Fixed lack of escaping of request dump at exception screens (samdark)
        return '<pre>' . $this->htmlEncode(rtrim($request, "\n")) . '</pre>';
CVE-2018-6009 (PHP, published 2018-01-22T22:29Z)
Description: value: In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/yiisoft/yii2
Files changed:
framework/CHANGELOG.md
framework/web/User.php
tests/framework/helpers/UrlTest.php
Commit message: Fixes #15496: CSRF token is now regenerated on changing identity



Vulnerable code:

Fixed code:

- Enh #15496: CSRF token is now regenerated on changing identity (samdark, rhertogh)

        // regenerate CSRF token
        Yii::$app->getRequest()->getCsrfToken(true);
                    'cookieValidationKey' => '123',
CVE-2020-15148 (Markdown, published 2020-09-15T19:15Z)
Description: value: Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/yiisoft/yii2
Files changed:
framework/CHANGELOG.md
framework/db/BatchQueryResult.php
Commit message: Merge pull request from GHSA-699q-wcff-g9mj

* Fix unsafe unserialize()

* Add changelog and comments on why unserialize() is disabled

* Add since tag

Vulnerable code:

Fixed code:
- Bug: (CVE-2020-15148): Disable unserialization of `yii\db\BatchQueryResult` to prevent remote code execution in case application calls unserialize() on user input containing specially crafted string (samdark, russtone)

    /**
     * Unserialization is disabled to prevent remote code execution in case application
     * calls unserialize() on user input containing specially crafted string.
     * @see CVE-2020-15148
     * @since 2.0.38
     */
    public function __wakeup()
    {
        throw new \BadMethodCallException('Cannot unserialize ' . __CLASS__);
    }
CVE-2024-32877 (Markdown, published 2024-05-30T20:15Z)
Description: value: Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting (XSS) vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 (2.0.49.3). This issue lies in the mechanism for displaying function argument values in the stack trace. The vulnerability manifests when an argument's value exceeds 32 characters. For convenience, argument values exceeding this limit are truncated and displayed with an added "...". The full argument value becomes visible when hovering over it with the mouse, as it is displayed in the title attribute of a span tag. However, the use of a double quote (") allows an attacker to break out of the title attribute's value context and inject their own attributes into the span tag, including malicious JavaScript code through event handlers such as onmousemove. This vulnerability allows an attacker to execute arbitrary JavaScript code in the security context of the victim's site via a specially crafted link. This could lead to the theft of cookies (including httpOnly cookies, which are accessible on the page), content substitution, or complete takeover of user accounts. This issue has been addressed in version 2.0.50. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/yiisoft/yii2
Files changed:
framework/CHANGELOG.md
framework/web/ErrorHandler.php
Commit message: Merge pull request from GHSA-qg5r-95m4-mjgj

* Hotfix: Reflected XSS in Debug mode

* Added entry for the security issue GHSA-qg5r-95m4-mjgj to the CHANGELOG

* Update CHANGELOG.md

* Update CHANGELOG.md

---------

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Vulnerable code:
        return htmlspecialchars($text, ENT_NOQUOTES | ENT_SUBSTITUTE | ENT_HTML5, 'UTF-8');

Fixed code:
- CVE-2024-32877: Fixed Reflected XSS in Debug mode (Antiphishing)
        return htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5, 'UTF-8');
CVE-2022-27815 (Other, published 2022-03-30T00:15Z)
Description: value: SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/waycrate/swhkd
Files changed:
Makefile
src/daemon.rs
Commit message: [patch] CVE-2022-27815


Vulnerable code:
    let pidfile: String = String::from("/tmp/swhkd.pid");
        seteuid(env::var("PKEXEC_UID").unwrap().parse::<u32>().unwrap()); // Dropping privileges to invoking user.

Fixed code:
	@mkdir -p /etc/$(DAEMON_BINARY)/runtime
	@sudo chown root:root /etc/$(DAEMON_BINARY)/runtime
	@sudo chmod 700 /etc/$(DAEMON_BINARY)/runtime
    let invoking_uid = env::var("PKEXEC_UID").unwrap().parse::<u32>().unwrap();
    let pidfile: String = String::from(format!("/etc/swhkd/runtime/swhkd_{}.pid", invoking_uid));
        seteuid(invoking_uid); // Dropping privileges to invoking user.
CVE-2022-27816 (Rust, published 2022-03-30T02:15Z)
Description: value: SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.
Severity: LOW (CVSS v3 base score: 7.1)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/waycrate/swhkd
Files changed:
src/server.rs
Commit message: [patch] CVE-2022-27816


Vulnerable code:
    let pid_file_path = String::from("/tmp/swhks.pid");

Fixed code:
    let pid_file_path = String::from(format!("/run/user/{}/swhks.pid", unistd::Uid::current()));