Metasploit is not following the XDG directory standards

[aaronfranke]

I noticed that it created a database at /home/aaronfranke/.msf4/db on my system. This is not following the XDG Base Directory Specification.

Steps to reproduce

How'd you do it?

1. Install and run Metasploit.
2. Note how it creates a directory in your home directory.

Expected behavior

Metasploit should create it in $XDG_CONFIG_HOME/msf4 or ~/.config/msf4.

Current behavior

Metasploit creates it in ~/.msf4

System stuff

Metasploit version

Framework: 5.0.5-dev-
Console  : 5.0.5-dev-

I installed Metasploit with:

• Kali package via apt
• Omnibus installer (nightly)
• Commercial/Community installer (from http://www.rapid7.com/products/metasploit/download.jsp)
• Source install (please specify ruby version)

OS

Ubuntu 18.04.

[busterb]

Good suggestion, though it does come at a cost of invalidating a decade of documentation on the internet and in print. Any suggestions for avoiding mass confusion in the process?

I think if we moved to .config we would probably also change from msf4 to metasploit at the same time.

[bcoles]

[aaronfranke]

@busterb You could have it create a symlink while the documentation is catching up, and remove the symlink after all the documentation has changed. As long as you test that the program works without the symlink (i.e. Metasploit always points to $XDG_CONFIG_HOME/metasploit and/or .config/metasploit).

[baj0k]

Hello,

since this issue is dead for 2 years now I would like to "reopen" it.
The application could simply check for configuration under $XDG_CONFIG_HOME/metasploit and if it wasn't available it would next look under $HOME/.config/metasploit and than fallback to currently used configuration which is $HOME/.msf4. If the configuration didn't exist in any of those locations the application would dump default configuration under $XDG_CONFIG_HOME/metasploit if the variable has been set or else under $HOME/.config/metasploit.

I just want to discuss it a little bit, because I hate last few dotfiles in my cluttered $HOME and I would like to manage my dotfiles properly in a standardized way.

[whois-sin]

Are there any updates on this? @baj0k I've been trying to figure it out for a while now as well.

[baj0k]

@busterb it's been more than 3 years since this issue was created. Implementing XDG specs is usually done by a few if statements in the code and should not be an issue. Could we please discuss this?

Supporting the XDG standard doesn't mean that the metasploit needs to drop currently supported directories in home (~/.msf4) and no documentation is going to be invalidated.
Basically what needs to be done:

• Currently all data is stored in ~/.msf4. The XDG spec is mostly adapted by splitting the application data like logs, databases from config files and cache.
  The first are stored in $XDG_DATA_HOME/metasploit which will usually point to ~/.local/share/metasploit.
  Similarly config files will be stored in $XDG_CONFIG_HOME/metasploit which will usually point to ~/.config/metasploit.
  Cached data should go to $XDG/CACHE/HOME/metasploit which will usually point to ~/.cache/metasploit.

• Supporting ~/.msf4 cannot be dropped because of the existing documentation and the mayhem it would cause for current users. Instead, when metasploit would need to save/load some files it should check if the $XDG_CONFIG_HOME/metasploit directory exists (and accordingly $XDG_DATA_HOME and $XDG_CACHE_HOME). If not then it should check $HOME/.config/metasploit and than fallback to $HOME/.msf4.

• If metasploit does not find any data at above locations the application should create its directories under the locations defined by $XDG variables. If these are not defined then it should use the usual paths ~/.config ~/.local/share and ~/.cache.

If something is not clear or you have any concerns or objections then let's discuss them. Thank you.

[Tony-Sol]

Strongly agree with @baj0k
XDG_Spec support would be really convenient