From 3517f4e76af8839370085995f5b40e8cc72fc5b3 Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 08:08:07 +0200
Subject: [PATCH] fix: preserve notices traversal under cap_drop ALL (#285)

---
 images/base/Dockerfile           | 6 +++++-
 scripts/test-validation-tools.sh | 8 ++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 mode change 100644 => 100755 scripts/test-validation-tools.sh

diff --git a/images/base/Dockerfile b/images/base/Dockerfile
index 6b96fa2..cfdfb99 100644
--- a/images/base/Dockerfile
+++ b/images/base/Dockerfile
@@ -223,12 +223,16 @@ RUN test "$(stat -c '%a' "$MISE_SYSTEM_CONFIG_DIR")" = 755 \
 
 # Keep project and bundled-component terms inspectable in both the repository and
 # the built image. Runtime archives contribute their own license files here.
+# Create the parent explicitly: COPY --chmod=0444 otherwise creates it as 0444,
+# which prevents traversal when CAP_DAC_OVERRIDE/CAP_DAC_READ_SEARCH are dropped.
+RUN install -d -o 0 -g 0 -m 0755 /usr/share/doc/remote-dev
 COPY --chmod=0444 LICENSE /usr/share/doc/remote-dev/LICENSE
 COPY third_party/ /usr/share/doc/remote-dev/third_party/
 COPY scripts/copy-runtime-notices.sh /usr/local/bin/copy-runtime-notices
 COPY scripts/remote-dev-notices.sh /usr/local/bin/remote-dev-notices
 RUN --mount=type=bind,source=scripts/print-locked-runtime-artifacts.py,target=/tmp/print-locked-runtime-artifacts.py,ro \
-    locked_runtime_manifest="$(python /tmp/print-locked-runtime-artifacts.py /etc/mise/mise.lock "${TARGETARCH}")" \
+    test "$(stat -c '%u:%g %a' /usr/share/doc/remote-dev)" = '0:0 755' \
+    && locked_runtime_manifest="$(python /tmp/print-locked-runtime-artifacts.py /etc/mise/mise.lock "${TARGETARCH}")" \
     && for expected in \
       "PYTHON_VERSION=${PYTHON_VERSION}" \
       "PYTHON_315_VERSION=${PYTHON_315_VERSION}" \
diff --git a/scripts/test-validation-tools.sh b/scripts/test-validation-tools.sh
old mode 100644
new mode 100755
index 924af11..7997ad9
--- a/scripts/test-validation-tools.sh
+++ b/scripts/test-validation-tools.sh
@@ -21,6 +21,14 @@ export RUFF_CACHE_DIR="$scratch/ruff-cache" UV_CACHE_DIR="$scratch/uv-cache"
 export PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
 unset MISE_TRUSTED_CONFIG_PATHS MISE_TRUSTED_CONFIG_FILES
 export PATH="/opt/remote-dev/mise/shims:/usr/local/bin:/usr/bin:/bin"
+# Read-only notice files must remain reachable without any DAC capabilities.
+notice_dir=/usr/share/doc/remote-dev
+notice_mode="$(stat -c '%u:%g %a' "$notice_dir")"
+if [[ "$notice_mode" != '0:0 755' ]]; then
+  printf 'ERROR: notices directory %s has %s; expected root:root 0755\n' "$notice_dir" "$notice_mode" >&2
+  exit 1
+fi
+remote-dev-notices --check
 mkdir -p "$scratch/neutral" "$scratch/project" "$scratch/untrusted"
 cd "$scratch/neutral"
 store_snapshot() { find /opt/remote-dev/mise -printf '%P %y %s %T@ %C@ %l\n' | LC_ALL=C sort; }