diff options
author | Lantao Liu <lantaol@google.com> | 2018-06-26 13:39:07 -0700 |
---|---|---|
committer | Shentubot <shentubot@google.com> | 2018-06-26 13:40:04 -0700 |
commit | 000fd8d1e4530b4063eead26dda4843ff0d71cbd (patch) | |
tree | 1c41986261d239b3cf247cb50fe8c044a1cb5553 /runsc/cmd | |
parent | ea10949a0036cdef95a1397ccad8fcc138ce3c0d (diff) |
runsc: set gofer umask to 0.
PiperOrigin-RevId: 202185642
Change-Id: I2eefcc0b2ffadc6ef21d177a8a4ab0cda91f3399
Diffstat (limited to 'runsc/cmd')
-rw-r--r-- | runsc/cmd/boot.go | 7 | ||||
-rw-r--r-- | runsc/cmd/gofer.go | 5 |
2 files changed, 12 insertions, 0 deletions
diff --git a/runsc/cmd/boot.go b/runsc/cmd/boot.go index 86f597c09..0d0e6b63f 100644 --- a/runsc/cmd/boot.go +++ b/runsc/cmd/boot.go @@ -107,6 +107,13 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) conf := args[0].(*boot.Config) waitStatus := args[1].(*syscall.WaitStatus) + // sentry should run with a umask of 0 when --file-access=direct, because we want + // to preserve file modes exactly as set by the sentry, which will have applied + // its own umask. + if conf.FileAccess == boot.FileAccessDirect { + syscall.Umask(0) + } + if b.applyCaps { caps := spec.Process.Capabilities if conf.Platform == boot.PlatformPtrace { diff --git a/runsc/cmd/gofer.go b/runsc/cmd/gofer.go index c0b747737..8e1060a35 100644 --- a/runsc/cmd/gofer.go +++ b/runsc/cmd/gofer.go @@ -17,6 +17,7 @@ package cmd import ( "os" "sync" + "syscall" "context" "flag" @@ -66,6 +67,10 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) return subcommands.ExitUsageError } + // fsgofer should run with a umask of 0, because we want to preserve file + // modes exactly as sent by the sandbox, which will have applied its own umask. + syscall.Umask(0) + spec, err := specutils.ReadSpec(g.bundleDir) if err != nil { Fatalf("error reading spec: %v", err) |