From 18013b0f033e7e99ea5fa9a53c8fe1ae59cac27e Mon Sep 17 00:00:00 2001
From: Prakash B R <prakash.b.r@intel.com>
Date: Wed, 2 Sep 2026 12:17:44 +0530
Subject: [PATCH] PTK0009079 Restrict compression binary permissions to 0o755

---
 setup.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index f0730dc..330970e 100644
--- a/setup.py
+++ b/setup.py
@@ -11,7 +11,8 @@ def run(self):
     if sys.platform.startswith('linux'):  # Just for linux, change the attributes
       for filepath in self.get_outputs():
         if filepath.find("LzmaCompress") > -1 or filepath.find("TianoCompress") > -1 or filepath.find("Brotli") > -1:
-          os.chmod(filepath, 0o777)
+          # 0o755: executable for everyone, writable only by the owner (avoids local privilege escalation)
+          os.chmod(filepath, 0o755)
 
 
 if __name__ == "__main__":