Merge pull request #12719 from zhangyoufu/patch-1

pkg/oci: add WithUmask for SpecOpts

pkg/oci/spec_opts.go

@@ -724,6 +724,16 @@ func WithUIDGID(uid, gid uint32) SpecOpts {
 	}
 }
 
+// WithUmask sets the process user's umask in the OCI spec's Process.User.Umask
+func WithUmask(umask uint32) SpecOpts {
+	return func(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {
+		setProcess(s)
+		u := umask
+		s.Process.User.Umask = &u
+		return nil
+	}
+}
+
 // WithUserID sets the correct UID and GID for the container based
 // on the image's /etc/passwd contents. If /etc/passwd does not exist,
 // or uid is not found in /etc/passwd, it sets the requested uid,

pkg/oci/spec_opts_unix_test.go

@@ -70,3 +70,45 @@ func TestWithImageConfigNoEnv(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestWithUmask_SetsUmaskOnEmptySpec(t *testing.T) {
+	t.Parallel()
+	var s Spec
+
+	if err := WithUmask(0o027)(nil, nil, nil, &s); err != nil {
+		t.Fatalf("WithUmask returned error: %v", err)
+	}
+	if s.Process == nil {
+		t.Fatalf("expected Process to be initialized")
+	}
+	if s.Process.User.Umask == nil {
+		t.Fatalf("expected Umask to be set")
+	}
+	if *s.Process.User.Umask != 0o027 {
+		t.Fatalf("unexpected umask: got %03O, want %03O", *s.Process.User.Umask, 0o027)
+	}
+}
+
+func TestWithUmask_WithDefaultSpec(t *testing.T) {
+	t.Parallel()
+	var s Spec
+	c := containers.Container{ID: t.Name()}
+	ctx := namespaces.WithNamespace(context.Background(), "test")
+
+	// populate defaults first
+	if err := populateDefaultUnixSpec(ctx, &s, c.ID); err != nil {
+		t.Fatalf("populateDefaultUnixSpec error: %v", err)
+	}
+
+	// apply umask
+	if err := WithUmask(0o077)(ctx, nil, &c, &s); err != nil {
+		t.Fatalf("WithUmask returned error: %v", err)
+	}
+
+	if s.Process == nil || s.Process.User.Umask == nil {
+		t.Fatalf("expected umask to be set on spec")
+	}
+	if *s.Process.User.Umask != 0o077 {
+		t.Fatalf("unexpected umask: got %03O, want %03O", *s.Process.User.Umask, 0o077)
+	}
+}