From f0ca17650e10e1a922a1cd95780c8449ec0d5490 Mon Sep 17 00:00:00 2001 From: Matthew Heon Date: Fri, 26 Jun 2020 10:07:20 -0400 Subject: Ensure umask is set appropriately for 'system service' We need a umask of 0022 to ensure containers are created correctly, but we set a different one prior to starting the server (to ensure the unix socket has the right permissions). Thus, we need to set the umask after the socket has been bound, but before the server begins accepting requests. Fixes #6787 Signed-off-by: Matthew Heon --- pkg/api/server/server.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkg/api/server/server.go b/pkg/api/server/server.go index bd6a99b96..5b2f8bea2 100644 --- a/pkg/api/server/server.go +++ b/pkg/api/server/server.go @@ -173,6 +173,10 @@ func (s *APIServer) Serve() error { }() } + // Before we start serving, ensure umask is properly set for container + // creation. + _ = syscall.Umask(0022) + go func() { err := s.Server.Serve(s.Listener) if err != nil && err != http.ErrServerClosed { -- cgit v1.2.3-54-g00ecf