When the IPC server process runs as root, the temporary directory it uses for communication is chowned to the user and group of the IPC client process [1]. However if qb_ipcs_connection_auth_set() [2] is used later on to change the ownership of the IPC connection, the directory is not chowned again, leading to wrong permissions as described in the upstream bug report [3].

As a result, IPC communication in USBGuard between the systemd service running as root and the usbguard client binary run by non-root users is completely broken, see the upstream reports [4,5].

A pull request to fix the issue in libqb has been submitted and merged [6,7]. Since libqb is only used by USBGuard and USBGuard is directly affected by this bug, I suggest backporting commit dd22a1811f76f4e16d42de4d9f783abc345c3c17 [8] to libqb.

Additional info:
* libqb 1.0.5-1
* usbguard 0.7.5-2

Steps to reproduce:

Install and start USBGuard, allow the current user to list devices:

sudo pacman -S usbguard
sudo systemctl start usbguard
sudo usbguard add-user -d list $USER
sudo systemctl restart usbguard

Now the following command should work as $USER, but fails with "ERROR: IPC connect: service=usbguard: Permission denied":

usbguard list-devices

Running the command as root works as expected. After cherry-picking dd22a1811f76f4e16d42de4d9f783abc345c3c17, the command works as expected.

[1] https://github.com/ClusterLabs/libqb/blob/d08dbcf08b0da418bce9b5427dfd89522916322a/lib/ipc_setup.c#L668
[2] https://github.com/ClusterLabs/libqb/blob/d08dbcf08b0da418bce9b5427dfd89522916322a/include/qb/qbipcs.h#L444
[3] https://github.com/ClusterLabs/libqb/issues/369
[4] https://github.com/USBGuard/usbguard/issues/289
[5] https://github.com/USBGuard/usbguard/issues/287
[6] https://github.com/ClusterLabs/libqb/pull/381
[7] https://github.com/ClusterLabs/libqb/pull/382
[8] https://github.com/ClusterLabs/libqb/commit/dd22a1811f76f4e16d42de4d9f783abc345c3c17