Insecure Permissions

github.com/hpcng/singularity uses insecure permissions. The insecure permissions on temporary directories used in fakeroot and user namespace container execution allows a user with access to the system to read the contents of the image during the build. If the image contains a world-writable file or directory, it is possible for an attacker to inject arbitrary content into the running build and potentially execute arbitrary code.