Fix crash-tracking script/directory permission lockdown

[jbachorik]

What Does This Do

Fixes permission inconsistency for the crash-uploader and OOME-notifier script initializers.
The code expects drwx------ but with the current version we get drwx------ | <whatever mask is default> and the crashtracker init check fails and crashtracking is disabled.

• The script directory is now created with permission bits fully cleared before the owner-only bits are set, so stray group/other read/write/execute bits inherited from the process umask are actually stripped (previously only the owner bits were set, leaving pre-existing group/other bits in place).
• In OOMENotifierScriptInitializer, the block that locks down the freshly-copied script file mistakenly operated on the script directory instead of the script file, leaving the copied script file's permissions unrestricted. It now correctly targets the script file.
• Added regression tests to ScriptInitializerSecurityTest asserting exact owner-only permissions on the created directories and on the OOME notifier script file.

Motivation

Unexpectedly wide privileges were left on the crash-tracking script directories/files, which prevented crash tracking from working.

Additional Notes

Jira ticket: PROF-15846

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 07272fd581

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-datadog-prod-us1]

A normal 0022 umask leaves the crash uploader script at mode 0544. The next JVM start rejects this script, and the new directory tests do not run the changed directory code.

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 97b09bd · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.79 s	14.74 s	[-0.3%; +1.0%] (no difference)
startup:insecure-bank:tracing:Agent	13.68 s	13.77 s	[-1.4%; +0.0%] (no difference)
startup:petclinic:appsec:Agent	17.38 s	17.32 s	[-0.7%; +1.4%] (no difference)
startup:petclinic:iast:Agent	17.46 s	17.55 s	[-1.5%; +0.5%] (no difference)
startup:petclinic:profiling:Agent	17.39 s	17.25 s	[-0.3%; +1.9%] (no difference)
startup:petclinic:sca:Agent	16.81 s	17.29 s	[-7.1%; +1.5%] (no difference)
startup:petclinic:tracing:Agent	16.54 s	16.18 s	[-2.1%; +6.6%] (no difference)

Commit: f1e6f66c · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.