Ubuntu Resolute base image contains world-writable /var/lib/pebble/default directory

[lbussell]

The ubuntu.azurecr.io:resolute base image ships with /var/lib/pebble/default as a world-writable directory without the sticky bit set. This causes the VerifyInsecureFiles test to fail for all .NET 11.

docker run --rm -u root --entrypoint /bin/sh ubuntu.azurecr.io/ubuntu:resolute -c "find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \)"

Output:

/var/lib/pebble/default

[lbussell]

Per @cjdcordeiro, the directory is intended to world-writable, but whether the sticky bit should be set is up in the air.

[cjdcordeiro]

Per @cjdcordeiro, the directory is intended to world-writable, but whether the sticky bit should be set is up in the air.

👍

This is now being tracked by the development team too at canonical/rockcraft#1170