Skip to content

fix: keep third-party notice directory traversable without DAC capabilities #285

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eXPerience83 merged 1 commit into from
Oct 21, 2026
Merged

fix: keep third-party notice directory traversable without DAC capabilities #285

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion images/base/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,12 +223,16 @@ RUN test "$(stat -c '%a' "$MISE_SYSTEM_CONFIG_DIR")" = 755 \

# Keep project and bundled-component terms inspectable in both the repository and
# the built image. Runtime archives contribute their own license files here.
# Create the parent explicitly: COPY --chmod=0444 otherwise creates it as 0444,
# which prevents traversal when CAP_DAC_OVERRIDE/CAP_DAC_READ_SEARCH are dropped.
RUN install -d -o 0 -g 0 -m 0755 /usr/share/doc/remote-dev
COPY --chmod=0444 LICENSE /usr/share/doc/remote-dev/LICENSE
COPY third_party/ /usr/share/doc/remote-dev/third_party/
COPY scripts/copy-runtime-notices.sh /usr/local/bin/copy-runtime-notices
COPY scripts/remote-dev-notices.sh /usr/local/bin/remote-dev-notices
RUN --mount=type=bind,source=scripts/print-locked-runtime-artifacts.py,target=/tmp/print-locked-runtime-artifacts.py,ro \
locked_runtime_manifest="$(python /tmp/print-locked-runtime-artifacts.py /etc/mise/mise.lock "${TARGETARCH}")" \
test "$(stat -c '%u:%g %a' /usr/share/doc/remote-dev)" = '0:0 755' \
&& locked_runtime_manifest="$(python /tmp/print-locked-runtime-artifacts.py /etc/mise/mise.lock "${TARGETARCH}")" \
&& for expected in \
"PYTHON_VERSION=${PYTHON_VERSION}" \
"PYTHON_315_VERSION=${PYTHON_315_VERSION}" \
Expand Down
8 changes: 8 additions & 0 deletions scripts/test-validation-tools.sh
100644 → 100755
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,14 @@ export RUFF_CACHE_DIR="$scratch/ruff-cache" UV_CACHE_DIR="$scratch/uv-cache"
export PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
unset MISE_TRUSTED_CONFIG_PATHS MISE_TRUSTED_CONFIG_FILES
export PATH="/opt/remote-dev/mise/shims:/usr/local/bin:/usr/bin:/bin"
# Read-only notice files must remain reachable without any DAC capabilities.
notice_dir=/usr/share/doc/remote-dev
notice_mode="$(stat -c '%u:%g %a' "$notice_dir")"
if [[ "$notice_mode" != '0:0 755' ]]; then
printf 'ERROR: notices directory %s has %s; expected root:root 0755\n' "$notice_dir" "$notice_mode" >&2
exit 1
fi
remote-dev-notices --check
mkdir -p "$scratch/neutral" "$scratch/project" "$scratch/untrusted"
cd "$scratch/neutral"
store_snapshot() { find /opt/remote-dev/mise -printf '%P %y %s %T@ %C@ %l\n' | LC_ALL=C sort; }
Expand Down
Loading