common: Restrict tmpdir permissions from 0777 to 0755

Browse Source

flatpak_allocate_tmpdir created child repo directories (repo- and
child-oci-) with mode 0777, allowing any local user to modify their
contents between the client pull and the system helper deploy.

Use 0755 instead, which prevents other users from writing while
still allowing the revokefs-fuse frontend to read the backing store
directly. The frontend runs as the calling user while the writer
backend runs as the flatpak system user, so the frontend needs
read access to directories created by the backend. Mode 0700 would
break this.

Resolves: CVE-2026-97026
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8

...

This commit is contained in:

500 Internal Server Error

Gitea Version: 1.28.0+dev-477-g8b6ad49a5f