pub fn home_dir_for_euid() -> Option<PathBuf>Expand description
Resolve the home directory of the current effective uid via
getpwuid_r, ignoring $HOME.
$HOME is part of the parent process’s environment and a malicious
parent can set it to anything (/, /tmp, an attacker-owned dir)
before exec’ing mkit. The kernel-side passwd database, by
contrast, is rooted in the system’s user store and tracks the same
uid used elsewhere in the security checks (load_raw_32’s owner
check, parent-dir mode check, etc.). Falling back to $HOME would
re-introduce the exact attack we’re trying to close, so we don’t.