opencontainers/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-10-23 19:49:01 +03:00
Code Activity

init: set umask regardless of mount namespace

Browse Source 
Setting the umask has nothing to do with the rootfs setup, yet it was done
in finalizeRootfs, which is only called when the container has its own mount
namespace. Because of that, a container without a mount namespace ignored
process.user.umask from the spec, and did not even set the default 0o022.

Move it to standard_init, keeping the original ordering (i.e. after the
rootfs is finalized), so that it is applied unconditionally.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2026-09-16 17:26:41 -07:00
parent 1fe7a6561a
commit 6659c4a2e5
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libcontainer/rootfs_linux.go
View File

@@ -295,11 +295,6 @@ func finalizeRootfs(config *configs.Config) (err error) {
}
}
if config.Umask != nil {
unix.Umask(int(*config.Umask))
} else {
unix.Umask(0o022)
}
return nil
}

8
libcontainer/standard_init_linux.go
View File

@@ -118,6 +118,14 @@ func (l *linuxStandardInit) Init() error {
}
}
// Set the umask. This is not related to the rootfs setup, so it has to be
// done even when the container does not have its own mount namespace.
if l.config.Config.Umask != nil {
unix.Umask(int(*l.config.Config.Umask))
} else {
unix.Umask(0o022)
}
if hostname := l.config.Config.Hostname; hostname != "" {
if err := unix.Sethostname([]byte(hostname)); err != nil {
return &os.SyscallError{Syscall: "sethostname", Err: err}