From 43a2b8d1bda096645396f46535cebbe16201d343 Mon Sep 17 00:00:00 2001 From: Arunesh Dwivedi Date: Sun, 23 Aug 2026 14:42:25 +0000 Subject: [PATCH] fix: use 0o755 for feature directory permissions Directories need execute bit for traversal, not file permissions. Using 0o644 prevents non-root users from accessing feature install scripts. Fixes #506. --- devcontainer/devcontainer.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devcontainer/devcontainer.go b/devcontainer/devcontainer.go index ea07bfcd..88abcfcd 100644 --- a/devcontainer/devcontainer.go +++ b/devcontainer/devcontainer.go @@ -227,7 +227,7 @@ func (s *Spec) compileFeatures(fs billy.Filesystem, devcontainerDir, scratchDir } featuresDir := filepath.Join(scratchDir, "features") - err := fs.MkdirAll(featuresDir, 0o644) + err := fs.MkdirAll(featuresDir, 0o755) if err != nil { return "", nil, fmt.Errorf("create features directory: %w", err) } @@ -277,7 +277,7 @@ func (s *Spec) compileFeatures(fs billy.Filesystem, devcontainerDir, scratchDir featureSha := md5.Sum([]byte(featureRefRaw)) featureName := filepath.Base(featureRef) featureDir := filepath.Join(featuresDir, fmt.Sprintf("%s-%x", featureName, featureSha[:4])) - if err := fs.MkdirAll(featureDir, 0o644); err != nil { + if err := fs.MkdirAll(featureDir, 0o755); err != nil { return "", nil, err } spec, err := features.Extract(fs, devcontainerDir, featureDir, featureRefRaw)