Root code execution via temporary-directory race

Privilege escalation in Timeshift before 20.03 allows local users to execute attacker-controlled scripts with root privileges. The init_tmp function trusts a preexisting predictable /tmp/timeshift directory, follows links, and runs temporary shell scripts from an attacker-replaceable subdirectory. Exploitation requires local access and winning the replacement race while a root-run Timeshift process creates and executes its script.