Age | Commit message (Collapse) | Author |
|
* Drop supplementary groups. Very likely, those are not mapped inside
and they cannot cause much good.
* Sane permission for the root directory. Otherwise no non-root user
can access any files.
|
|
|
|
When TMPDIR has restrictive permissions, the namespace may be unable to
access the leading components. Thus we put the supervisor process
handling the cleanup into a different namespace that has all the ids
plus the current uid mapped. It'll then be able to perform the cleanup
(and the initial chown).
|
|
|
|
* Add execute bit
* Consume first positional argument
|
|
|
|
Most frequently, the root user is allocated.
|
|
|
|
|
|
|