From d3ca96da556ddaca4fed8c0446ded5d65fe20f4c Mon Sep 17 00:00:00 2001
From: Ayush Ranjan <ayushranjan@google.com>
Date: Fri, 11 Oct 2024 12:43:54 -0700
Subject: [PATCH] Add support for spec.Process.User.Umask.

If this field is specified, then initialize kernel.CreateProcessArgs.Umask with
it. Otherwise default to 0022.

Fixes #11022

PiperOrigin-RevId: 684925583
---
 runsc/boot/loader.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index 7087b31d1..cc94d205c 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -703,13 +703,18 @@ func createProcessArgs(id string, spec *specs.Spec, conf *config.Config, creds *
 		wd = "/"
 	}
 
+	umask := uint(0022)
+	if spec.Process.User.Umask != nil {
+		umask = uint(*spec.Process.User.Umask) & 0777
+	}
+
 	// Create the process arguments.
 	procArgs := kernel.CreateProcessArgs{
 		Argv:                 spec.Process.Args,
 		Envv:                 env,
 		WorkingDirectory:     wd,
 		Credentials:          creds,
-		Umask:                0022,
+		Umask:                umask,
 		Limits:               ls,
 		MaxSymlinkTraversals: linux.MaxSymlinkTraversals,
 		UTSNamespace:         k.RootUTSNamespace(),