diff --git a/patch/0131-runc-support-specify-umask.patch b/patch/0131-runc-support-specify-umask.patch
new file mode 100644
index 0000000000000000000000000000000000000000..c3ece811922728b506bc293d150ecfe0ba18d280
--- /dev/null
+++ b/patch/0131-runc-support-specify-umask.patch
@@ -0,0 +1,57 @@
+From 9e76966232e71cfabc2553c6a0dee1f59ee9216c Mon Sep 17 00:00:00 2001
+From: zhongjiawei <zhongjiawei1@huawei.com>
+Date: Sat, 17 Dec 2022 11:18:41 +0800
+Subject: [PATCH] runc:support specify umask
+
+---
+ libcontainer/rootfs_linux.go     | 7 ++++++-
+ libcontainer/setns_init_linux.go | 8 ++++++++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
+index a1bd7e7..b005429 100644
+--- a/libcontainer/rootfs_linux.go
++++ b/libcontainer/rootfs_linux.go
+@@ -140,7 +140,12 @@ func finalizeRootfs(config *configs.Config) (err error) {
+ 		}
+ 	}
+ 
+-	syscall.Umask(0022)
++	umask := libcontainerUtils.SearchLabels(config.Labels, "native.umask")
++	if umask == "normal" {
++		syscall.Umask(0022)
++	} else {
++		syscall.Umask(0027)
++	}
+ 	return nil
+ }
+ 
+diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
+index e6dfbba..1f7ec98 100644
+--- a/libcontainer/setns_init_linux.go
++++ b/libcontainer/setns_init_linux.go
+@@ -11,6 +11,7 @@ import (
+ 	"github.com/opencontainers/runc/libcontainer/keys"
+ 	"github.com/opencontainers/runc/libcontainer/seccomp"
+ 	"github.com/opencontainers/runc/libcontainer/system"
++	"github.com/opencontainers/runc/libcontainer/utils"
+ 	"github.com/opencontainers/selinux/go-selinux/label"
+ )
+ 
+@@ -42,6 +43,13 @@ func (l *linuxSetnsInit) Init() error {
+ 			return err
+ 		}
+ 	}
++	// set exec process umask to 0027 or 0022 according to container's config
++	umask := utils.SearchLabels(l.config.Config.Labels, "native.umask")
++	if umask == "normal" {
++		syscall.Umask(0022)
++	} else {
++		syscall.Umask(0027)
++	}
+ 	if l.config.NoNewPrivileges {
+ 		if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+ 			return err
+-- 
+2.30.0
+
diff --git a/runc.spec b/runc.spec
index cadc61f875d554bcec7d581499ebad14efece133..329af57948a80c78824aa64342cdb8696d09cfd9 100644
--- a/runc.spec
+++ b/runc.spec
@@ -2,7 +2,7 @@
 
 Name: docker-runc
 Version: 1.0.0.rc3
-Release: 207
+Release: 208
 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification.
 
 License: ASL 2.0
@@ -41,6 +41,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
 %{_bindir}/runc
 
 %changelog
+* Sat Dec 17 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-208
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:support specify umask
+
 * Wed Sep 28 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-207
 - Type:bugfix
 - ID:NA
diff --git a/series.conf b/series.conf
index af420f278d55172bf8fb445a2e761fd143ba031f..88f182b6bdf3715fa5e521b870454e7aef002c4a 100644
--- a/series.conf
+++ b/series.conf
@@ -122,3 +122,4 @@
 0128-runc-fix-CVE-2022-29162.patch
 0129-runc-Makefile-modify.patch
 0130-runc-add-logs.patch
+0131-runc-support-specify-umask.patch