From db278bdf2f58010276690895154e9ce952dae7d5 Mon Sep 17 00:00:00 2001
From: zhongjiawei <zhongjiawei1@huawei.com>
Date: Tue, 9 Aug 2022 20:35:39 +0800
Subject: [PATCH] runc: change Umask to 0022

---
 patch/0131-runc-change-Umask-to-0022.patch | 57 ++++++++++++++++++++++
 runc-openeuler.spec                        |  8 ++-
 series.conf                                |  1 +
 3 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 patch/0131-runc-change-Umask-to-0022.patch

diff --git a/patch/0131-runc-change-Umask-to-0022.patch b/patch/0131-runc-change-Umask-to-0022.patch
new file mode 100644
index 0000000..63a562d
--- /dev/null
+++ b/patch/0131-runc-change-Umask-to-0022.patch
@@ -0,0 +1,57 @@
+From f53243d64903d660e45a186dc11fa0ab13c39621 Mon Sep 17 00:00:00 2001
+From: zhongjiawei <zhongjiawei1@huawei.com>
+Date: Tue, 9 Aug 2022 18:29:53 +0800
+Subject: [PATCH] runc: change Umask to 0022
+
+---
+ libcontainer/rootfs_linux.go     | 7 +------
+ libcontainer/setns_init_linux.go | 8 --------
+ 2 files changed, 1 insertion(+), 14 deletions(-)
+
+diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
+index b005429..a1bd7e7 100644
+--- a/libcontainer/rootfs_linux.go
++++ b/libcontainer/rootfs_linux.go
+@@ -140,12 +140,7 @@ func finalizeRootfs(config *configs.Config) (err error) {
+ 		}
+ 	}
+ 
+-	umask := libcontainerUtils.SearchLabels(config.Labels, "native.umask")
+-	if umask == "normal" {
+-		syscall.Umask(0022)
+-	} else {
+-		syscall.Umask(0027)
+-	}
++	syscall.Umask(0022)
+ 	return nil
+ }
+ 
+diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
+index 1f7ec98..e6dfbba 100644
+--- a/libcontainer/setns_init_linux.go
++++ b/libcontainer/setns_init_linux.go
+@@ -11,7 +11,6 @@ import (
+ 	"github.com/opencontainers/runc/libcontainer/keys"
+ 	"github.com/opencontainers/runc/libcontainer/seccomp"
+ 	"github.com/opencontainers/runc/libcontainer/system"
+-	"github.com/opencontainers/runc/libcontainer/utils"
+ 	"github.com/opencontainers/selinux/go-selinux/label"
+ )
+ 
+@@ -43,13 +42,6 @@ func (l *linuxSetnsInit) Init() error {
+ 			return err
+ 		}
+ 	}
+-	// set exec process umask to 0027 or 0022 according to container's config
+-	umask := utils.SearchLabels(l.config.Config.Labels, "native.umask")
+-	if umask == "normal" {
+-		syscall.Umask(0022)
+-	} else {
+-		syscall.Umask(0027)
+-	}
+ 	if l.config.NoNewPrivileges {
+ 		if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+ 			return err
+-- 
+2.30.0
+
diff --git a/runc-openeuler.spec b/runc-openeuler.spec
index 6e1d701..ae924d2 100644
--- a/runc-openeuler.spec
+++ b/runc-openeuler.spec
@@ -4,7 +4,7 @@
 
 Name: docker-runc
 Version: 1.0.0.rc3
-Release: 301
+Release: 302
 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification.
 
 License: ASL 2.0
@@ -53,6 +53,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
 %{_bindir}/runc
 
 %changelog
+* Tue Aug 09 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-302
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:change Umask to 0022
+
 * Tue Aug 09 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.0.0.rc3-301
 - Type:bugfix
 - CVE:NA
diff --git a/series.conf b/series.conf
index b5d1f52..57c50e2 100644
--- a/series.conf
+++ b/series.conf
@@ -129,4 +129,5 @@ patch/0128-runc-optimize-nsexec-logging.patch
 patch/0129-runc-improve-log-for-debugging.patch
 patch/0130-runc-fix-cgroup-info-print-error.patch
 patch/0128-runc-fix-CVE-2022-29162.patch
+patch/0131-runc-change-Umask-to-0022.patch
 #end
-- 
Gitee