From 34da7a694c6334d25f0b13ad49aa0dfdc89684ea Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 6 Dec 2017 13:29:34 +0100 Subject: [PATCH] config: add "umask" field to POSIX "user" section Users may want to specify the umask(2) of the init process in a container. This value is identical in semantics to POSIX. This is in order to allow usage of an OCI container for a service which normally only inherits the umask given to it. Signed-off-by: Aleksa Sarai --- config.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config.md b/config.md index 06801f5dd..4b86b35c2 100644 --- a/config.md +++ b/config.md @@ -217,6 +217,7 @@ For POSIX platforms the `user` structure has the following fields: * **`uid`** (int, REQUIRED) specifies the user ID in the [container namespace](glossary.md#container-namespace). * **`gid`** (int, REQUIRED) specifies the group ID in the [container namespace](glossary.md#container-namespace). +* **`umask`** (int, OPTIONAL) specifies the [umask][umask_2] of the user. If unspecified, the umask should not be changed from the calling process' umask. * **`additionalGids`** (array of ints, OPTIONAL) specifies additional group IDs in the [container namespace](glossary.md#container-namespace) to be added to the process. _Note: symbolic name for uid and gid, such as uname and gname respectively, are left to upper levels to derive (i.e. `/etc/passwd` parsing, NSS, etc)_ @@ -233,6 +234,7 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are "user": { "uid": 1, "gid": 1, + "umask": 63, "additionalGids": [5, 6] }, "env": [ @@ -291,6 +293,7 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are "user": { "uid": 1, "gid": 1, + "umask": 7, "additionalGids": [2, 8] }, "env": [ @@ -843,6 +846,7 @@ Here is a full example `config.json` for reference. [selinux]:http://selinuxproject.org/page/Main_Page [no-new-privs]: https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt [proc_2]: https://www.kernel.org/doc/Documentation/filesystems/proc.txt +[umask.2]: http://pubs.opengroup.org/onlinepubs/009695399/functions/umask.html [semver-v2.0.0]: http://semver.org/spec/v2.0.0.html [ieee-1003.1-2008-xbd-c8.1]: http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_01 [ieee-1003.1-2008-functions-exec]: http://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html