From 6659c4a2e5f50beda100fbc33ac80c56a22092e4 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 16 Sep 2026 17:26:41 -0700 Subject: [PATCH] init: set umask regardless of mount namespace Setting the umask has nothing to do with the rootfs setup, yet it was done in finalizeRootfs, which is only called when the container has its own mount namespace. Because of that, a container without a mount namespace ignored process.user.umask from the spec, and did not even set the default 0o022. Move it to standard_init, keeping the original ordering (i.e. after the rootfs is finalized), so that it is applied unconditionally. Signed-off-by: Kir Kolyshkin --- libcontainer/rootfs_linux.go | 5 ----- libcontainer/standard_init_linux.go | 8 ++++++++ 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 35571a298..84ba55e05 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -295,11 +295,6 @@ func finalizeRootfs(config *configs.Config) (err error) { } } - if config.Umask != nil { - unix.Umask(int(*config.Umask)) - } else { - unix.Umask(0o022) - } return nil } diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go index afc4cbb09..43ed700f2 100644 --- a/libcontainer/standard_init_linux.go +++ b/libcontainer/standard_init_linux.go @@ -118,6 +118,14 @@ func (l *linuxStandardInit) Init() error { } } + // Set the umask. This is not related to the rootfs setup, so it has to be + // done even when the container does not have its own mount namespace. + if l.config.Config.Umask != nil { + unix.Umask(int(*l.config.Config.Umask)) + } else { + unix.Umask(0o022) + } + if hostname := l.config.Config.Hostname; hostname != "" { if err := unix.Sethostname([]byte(hostname)); err != nil { return &os.SyscallError{Syscall: "sethostname", Err: err}