diff options
| author | Ophestra <cat@gensokyo.uk> | 2026-10-18 18:31:30 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2026-10-18 18:31:30 +0900 |
| commit | f92b4673a19272d8eda1302f3a36cb6073113f83 (patch) | |
| tree | 2dd8f154882736b557ff8c8cac0dabe03c79efe8 /internal/outcome/spruntime.go | |
| parent | bdca60d4959919a02f744457aaade3d9e2425f3a (diff) | |
internal/outcome: world-executable runtime/tmpdir
This does not reduce security, and saves the trouble of the additional
ACL setup/teardowns.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/outcome/spruntime.go')
| -rw-r--r-- | internal/outcome/spruntime.go | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/internal/outcome/spruntime.go b/internal/outcome/spruntime.go index 55feac1d..b8121bfa 100644 --- a/internal/outcome/spruntime.go +++ b/internal/outcome/spruntime.go @@ -76,8 +76,7 @@ type spRuntimeOp struct { func (s *spRuntimeOp) toSystem(state *outcomeStateSys) error { if state.Container.Flags&hst.FShareRuntime != 0 { runtimeDir, runtimeDirInst := s.commonPaths(state.outcomeState) - state.sys.Ensure(runtimeDir, 0700, true) - state.sys.UpdatePermType(system.User, runtimeDir, acl.Execute) + state.sys.Ensure(runtimeDir, 0711, false) state.sys.Ensure(runtimeDirInst, 0700, true) state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read|acl.Write|acl.Execute) } |