| Age | Commit message (Collapse) | Author |
|---|
|
|
|
When decompression fails, we should raise a tarfile.ReadError rather
than a zstandard.ZstdError. Otherwise, tarfile gives up guessing.
|
|
* Drop supplementary groups. Very likely, those are not mapped inside
and they cannot cause much good.
* Sane permission for the root directory. Otherwise no non-root user
can access any files.
|
|
When TMPDIR has restrictive permissions, the namespace may be unable to
access the leading components. Thus we put the supervisor process
handling the cleanup into a different namespace that has all the ids
plus the current uid mapped. It'll then be able to perform the cleanup
(and the initial chown).
|
|
|
