From 40f00d570e10ba03910d16b734cc75817b83d00e Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 24 Mar 2025 12:45:19 +0900 Subject: sandbox: set mkdir perm Signed-off-by: Ophestra --- sandbox/mount.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'sandbox/mount.go') diff --git a/sandbox/mount.go b/sandbox/mount.go index 6683aaec..abad54c1 100644 --- a/sandbox/mount.go +++ b/sandbox/mount.go @@ -101,7 +101,7 @@ func remountWithFlags(n *vfs.MountInfoNode, mf uintptr) error { func mountTmpfs(fsname, name string, size int, perm os.FileMode) error { target := toSysroot(name) - if err := os.MkdirAll(target, perm); err != nil { + if err := os.MkdirAll(target, parentPerm(perm)); err != nil { return msg.WrapErr(err, err.Error()) } opt := fmt.Sprintf("mode=%#o", perm) @@ -112,3 +112,14 @@ func mountTmpfs(fsname, name string, size int, perm os.FileMode) error { syscall.MS_NOSUID|syscall.MS_NODEV, opt), fmt.Sprintf("cannot mount tmpfs on %q:", name)) } + +func parentPerm(perm os.FileMode) os.FileMode { + pperm := 0755 + if perm&0070 == 0 { + pperm &= ^0050 + } + if perm&0007 == 0 { + pperm &= ^0005 + } + return os.FileMode(pperm) +} -- cgit v1.3.1