Runc: Option to set umask of exec-user

Created on 13 Nov 2017 · 7Comments · Source: opencontainers/runc

Hi,
As mentioned here https://github.com/moby/moby/issues/19189 it would be nice to have an option to enforce umask setting of the executing user.

Source

leberknecht

👍3

Most helpful comment

I've opened the OCI spec PR here: opencontainers/runtime-spec#941.

cyphar on 6 Dec 2017

👍3

All 7 comments

So, this would need to be done through the config.json for OCI runtimes (which requires a specification. change), As far as I can tell, you're not really familiar with OCI specifications, so I could submit the relevant PR for you.

However, there is a property of umask(2) that might make this unnecessary. Most notably, umask(2) is preserved across both fork(2) and execve(2) -- so really whatever is calling runc is able to set its own umask(2) explicitly. In the world of Docker, this would mean that containerd could set umask(2) before spawning runc.

cyphar on 13 Nov 2017

Ok, then i will close this one and re-open an issue on containerd.
Thanks for pointing out :)

leberknecht on 13 Nov 2017

I'm reopening, since I didn't mean to say that this is something that runc shouldn't do -- I was just mentioning that as a point that might come up in the spec discussion. :wink:

cyphar on 13 Nov 2017

I've opened the OCI spec PR here: opencontainers/runtime-spec#941.

cyphar on 6 Dec 2017

👍3

Has there been any progress on this issue recently? Anything that needs unblocking? Thanks.