← Back to issue list

missing sticky bit in PEBBLE_PATH

View original Github issue

Metadata

Project
rockcraft
Number
#1170
Type
issue
State
closed
Author
cjdcordeiro
Labels
Status: Triaged
Created
Updated
Closed

Current evaluation

Rockcraft now sets Pebble's default directory to mode 01777, adding the missing sticky bit; the fix was merged in canonical/rockcraft#1317 (88c7ae17).

Resolution: closed resolved

Reason: PR canonical/rockcraft#1317 was merged as commit 88c7ae17. It applies mode 01777 to Pebble's default directory in both creation paths and adds tests covering implicit and generated Pebble layers.

Evaluated by: mr-cal-bot

No scores available.

Issue body

### Check existing issues - [x] I've verified that this bug isn't described by any existing issues. ### Bug description May not be a bug, but definitely a security-related consideration that may need to be revisited, to ensure it was either done on purpose, and if so, to document why, or if not, to fix it. The original thread comes from https://github.com/dotnet/dotnet-docker/issues/7054. Once addressed, please provide feedback in that thread. ### Steps to reproduce `rockcraft pack` any rock ### Environment Should be the case on any rockcraft version and underlying environment, since the culprit is the implicit Pebble part. ### rockcraft.yaml ```yaml ``` ### Log output ```shell ```

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Rockcraft now sets Pebble's default directory to mode 01777, adding the missing sticky bit; the fix was merged in canonical/rockcraft#1317 (88c7ae17).
stealth/space-bunny-alpha — closed resolved Fixed by merged PR canonical/rockcraft#1317 (commit 88c7ae17), setting Pebble’s default directory to mode 01777 in both creation paths and adding coverage.
stealth/space-bunny-alpha — closed resolved Fixed in canonical/rockcraft#1317 via commit 88c7ae17, setting /var/lib/pebble/default to mode 01777 and adding coverage for Pebble layers.
stealth/space-bunny-alpha — closed resolved Pebble's default directory now has the sticky bit, restricting cross-user file removal. Fix merged in canonical/rockcraft#1317 as commit 88c7ae17.
qwen/qwen3.6-35b-a3b — — Resolved via pull request #1317, which implements the missing sticky bit for PEBBLE_PATH. The issue is closed pending PR merge.
qwen/qwen3.6-35b-a3b
Staleness: 10
Complexity: 25
Confidence: 95
Support Request: 5
keep open Potential security concern regarding a missing sticky bit in PEBBLE_PATH. The issue is triaged, acknowledged by maintainers, and references a proposed fix in PR #1317. Currently awaiting review or merge.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 20
Confidence: 90
Support Request: 10
keep open Security consideration regarding missing sticky bit in PEBBLE_PATH. Triaged and acknowledged by maintainers, with a proposed fix in PR #1317 under discussion.
qwen/qwen3.6-35b-a3b
Staleness: 45
Complexity: 20
Confidence: 85
Support Request: 10
needs triage Potential security concern regarding missing sticky bit on PEBBLE_PATH in rockcraft. Raised by maintainer, currently awaiting triage and sprint assignment.
qwen3.6-35b-a3b-mtp-q6
Staleness: 45
Complexity: 20
Confidence: 80
Support Request: 10
needs triage Potential security concern regarding a missing sticky bit in PEBBLE_PATH within the implicit Pebble part. Currently unlabelled and awaiting maintainer triage after an author ping for sprint consideration.
qwen3.6-35b-a3b-mtp-q6
Staleness: 40
Complexity: 20
Confidence: 85
Support Request: 10
needs triage Potential security issue regarding a missing sticky bit on PEBBLE_PATH in the implicit Pebble part. Recently pinged by a maintainer for sprint consideration but remains unlabelled and untriaged.

Update history

Date Change
closed
updated

Related work

  • Likely Fixed By: canonical/rockcraft#1317 (confidence 100%)

    Merged PR #1317 resolved the issue in commit 88c7ae17 by setting the default directory's sticky bit and adding coverage.

Related issues

Issue Project State Summary Similarity
#711 Set PATH on the rock for bare bases rockcraft closed Fixed in canonical/rockcraft#725 via commit b81a12c8, which sets Pebble's standard PATH on bare-based rock images.
75%
#1317 fix: set sticky bit on the default directory rockcraft merged Merged #1317 in commit 88c7ae17, changing /var/lib/pebble/default from 0777 to 01777 in both creation paths and adding permission coverage; fixes #1170.
74%
#473 fix(pebble): /var/lib/pebble/default has mode 0777 rockcraft merged Merged PR #473 via commit 72c1af5d, fixing #461 by always setting /var/lib/pebble/default to mode 0777, including rocks without services or checks.
71%
#763 fix: accept a 'pebble' part if its the same as ours rockcraft merged Merged in canonical/rockcraft#763 (commit d77ac5ac), accepting an existing Pebble part when identical to Rockcraft’s injected part and fixing expand-extensions builds.
71%