From 01fd590a770a2289e956a424cf27cfbac97de6c6 Mon Sep 17 00:00:00 2001
From: Youfu Zhang <zhangyoufu@gmail.com>
Date: Mon, 22 Dec 2025 08:41:44 +0000
Subject: [PATCH] pkg/oci: add WithUmask for SpecOpts

opencontainers/runtime-spec#941 added umask field and released with v1.0.2.
This commit add the missing helper function for this field.

Signed-off-by: Youfu Zhang <zhangyoufu@gmail.com>
---
 pkg/oci/spec_opts.go           | 10 ++++++++
 pkg/oci/spec_opts_unix_test.go | 42 ++++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)

diff --git a/pkg/oci/spec_opts.go b/pkg/oci/spec_opts.go
index 863b9dc444..8338279b90 100644
--- a/pkg/oci/spec_opts.go
+++ b/pkg/oci/spec_opts.go
@@ -724,6 +724,16 @@ func WithUIDGID(uid, gid uint32) SpecOpts {
 	}
 }
 
+// WithUmask sets the process user's umask in the OCI spec's Process.User.Umask
+func WithUmask(umask uint32) SpecOpts {
+	return func(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {
+		setProcess(s)
+		u := umask
+		s.Process.User.Umask = &u
+		return nil
+	}
+}
+
 // WithUserID sets the correct UID and GID for the container based
 // on the image's /etc/passwd contents. If /etc/passwd does not exist,
 // or uid is not found in /etc/passwd, it sets the requested uid,
diff --git a/pkg/oci/spec_opts_unix_test.go b/pkg/oci/spec_opts_unix_test.go
index ef06ecdfee..27bc67c379 100644
--- a/pkg/oci/spec_opts_unix_test.go
+++ b/pkg/oci/spec_opts_unix_test.go
@@ -70,3 +70,45 @@ func TestWithImageConfigNoEnv(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestWithUmask_SetsUmaskOnEmptySpec(t *testing.T) {
+	t.Parallel()
+	var s Spec
+
+	if err := WithUmask(0o027)(nil, nil, nil, &s); err != nil {
+		t.Fatalf("WithUmask returned error: %v", err)
+	}
+	if s.Process == nil {
+		t.Fatalf("expected Process to be initialized")
+	}
+	if s.Process.User.Umask == nil {
+		t.Fatalf("expected Umask to be set")
+	}
+	if *s.Process.User.Umask != 0o027 {
+		t.Fatalf("unexpected umask: got %03O, want %03O", *s.Process.User.Umask, 0o027)
+	}
+}
+
+func TestWithUmask_WithDefaultSpec(t *testing.T) {
+	t.Parallel()
+	var s Spec
+	c := containers.Container{ID: t.Name()}
+	ctx := namespaces.WithNamespace(context.Background(), "test")
+
+	// populate defaults first
+	if err := populateDefaultUnixSpec(ctx, &s, c.ID); err != nil {
+		t.Fatalf("populateDefaultUnixSpec error: %v", err)
+	}
+
+	// apply umask
+	if err := WithUmask(0o077)(ctx, nil, &c, &s); err != nil {
+		t.Fatalf("WithUmask returned error: %v", err)
+	}
+
+	if s.Process == nil || s.Process.User.Umask == nil {
+		t.Fatalf("expected umask to be set on spec")
+	}
+	if *s.Process.User.Umask != 0o077 {
+		t.Fatalf("unexpected umask: got %03O, want %03O", *s.Process.User.Umask, 0o077)
+	}
+}