[debatable] Make rootfs 700?

[hallyn]

This could fall under "don't shoot yourself in the foot", but if I

umoci unpack  --image oci:alpine alpine

then alpine/rootfs is world descendable. This means if there are any setuid-root exploitable binaries in the roots, an unprivileged user may be able to get to them.

Like I say, I understand if you choose to ignore it, but I thought I should point it out.

[cyphar]

This is actually something I've thought about before. I completely agree that we should make some aspect of the path 700, but I was thinking of making the bundle 700 to avoid including that mode inside the rootfs when repacking.

[hallyn]

Awesome, thanks.