From 1f916b5a69c09c72a9dbce979b8934e0ce57b5f5 Mon Sep 17 00:00:00 2001 From: Thomas Bechtold Date: Wed, 18 Feb 2026 17:21:33 +0100 Subject: [PATCH] wolfi-baselayout: set /var/tmp permissions to 1777 /var/tmp was being created via mkdir -p with default 0755 permissions. Every major distro (Alpine, Ubuntu, Debian, Fedora, Arch) sets /var/tmp to 1777 (drwxrwxrwt), same as /tmp, since it is a shared temporary directory that any user should be able to write to. This was already fixed for /tmp in 0744eb9723 but /var/tmp was missed. The incorrect permissions caused failures in images like selenium-standalone-chromium where Xvfb uses -fbdir /var/tmp and the non-root seluser could not write to it. Fixes: https://github.com/chainguard-dev/customer-issues/issues/3131 --- wolfi-baselayout.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/wolfi-baselayout.yaml b/wolfi-baselayout.yaml index 930c4a50da79..f81b752f5cec 100644 --- a/wolfi-baselayout.yaml +++ b/wolfi-baselayout.yaml @@ -1,7 +1,7 @@ package: name: wolfi-baselayout version: 20230201 - epoch: 26 + epoch: 27 description: "baselayout data for Wolfi" copyright: - license: MIT @@ -53,9 +53,11 @@ pipeline: mkdir -p "${{targets.destdir}}"/${i} done - # be explicit here, and create tmp as 1777 (drwxrwxrwt) even though - # apko does this itself in its baseDirectories / initDB + # be explicit here, and create tmp and var/tmp as 1777 (drwxrwxrwt). + # apko also sets /tmp to 1777 in its baseDirectories / initDB, + # but does not handle /var/tmp. chmod 1777 "${{targets.destdir}}/tmp" + chmod 1777 "${{targets.destdir}}/var/tmp" # usr-merge ln -sf usr/bin ${{targets.destdir}}/sbin