Option to set umask of exec-user

[leberknecht]

Hi,
As mentioned here moby/moby#19189 it would be nice to have an option to enforce umask setting of the executing user.

[cyphar]

So, this would need to be done through the config.json for OCI runtimes (which requires a specification. change), As far as I can tell, you're not really familiar with OCI specifications, so I could submit the relevant PR for you.

However, there is a property of umask(2) that might make this unnecessary. Most notably, umask(2) is preserved across both fork(2) and execve(2) -- so really whatever is calling runc is able to set its own umask(2) explicitly. In the world of Docker, this would mean that containerd could set umask(2) before spawning runc.

[leberknecht]

Ok, then i will close this one and re-open an issue on containerd.
Thanks for pointing out :)

[cyphar]

I'm reopening, since I didn't mean to say that this is something that runc shouldn't do -- I was just mentioning that as a point that might come up in the spec discussion. 😉

[cyphar]

I've opened the OCI spec PR here: opencontainers/runtime-spec#941.

[phod]

Has there been any progress on this issue recently? Anything that needs unblocking? Thanks.

[cyphar]

The OCI spec PR needs to be merged first.

[leberknecht]

@cyphar meanwhile the PR was merged :) what would be the next steps? Anything we can help with?

[leberknecht]

@cyphar ping

[cyphar]

Sorry I missed your message from a year ago 😬. I'm pretty sure this is fully supported since #2527 -- which will be in the next release. So the next steps would be to add containerd and Docker support for it, and then pull in the new version of runc which I'll be releasing tomorrow.