Fix TOCTOU race bug in tar extraction

shachartal · k8s-infra-cherrypick-robot · commit fbed68b8fb97 · 2026-03-04T01:05:45.000Z
Signed-off-by: Shachar Tal &lt;stal@paloaltonetworks.com&gt;
diff --git a/pkg/archive/tar_unix.go b/pkg/archive/tar_unix.go
@@ -80,7 +80,7 @@ func openFile(name string, flag int, perm os.FileMode) (*os.File, error) {
 		return nil, err
 	}
 	// Call chmod to avoid permission mask
-	if err := os.Chmod(name, perm); err != nil {
+	if err := f.Chmod(perm); err != nil {
 		f.Close()
 		return nil, err
 	}

Original file line number	Diff line number	Diff line change
`@@ -80,7 +80,7 @@ func openFile(name string, flag int, perm os.FileMode) (*os.File, error) {`
`80`	`80`	`return nil, err`
`81`	`81`	`}`
`82`	`82`	`// Call chmod to avoid permission mask`
`83`		`- if err := os.Chmod(name, perm); err != nil {`
	`83`	`+ if err := f.Chmod(perm); err != nil {`
`84`	`84`	`f.Close()`
`85`	`85`	`return nil, err`
`86`	`86`	`}`