!275 runc：do not support set umask through native.umask

From: @zhong-jiawei-1 
Reviewed-by: @zhangsong234 
Signed-off-by: @zhangsong234

git-commit

@@ -1 +1 @@
-39ef8dd8b1069e96008306023d05d2f84c435fff
+593dbd81f34d8d33d46906c17cb07c4011956cea

patch/0043-runc-do-not-support-set-umask-through-native.umask.patch

@@ -0,0 +1,48 @@
+From 19a4209a82132f930fe55cbb2255eb453b465e56 Mon Sep 17 00:00:00 2001
+From: zhongjiawei <zhongjiawei1@huawei.com>
+Date: Thu, 11 Jul 2024 20:18:01 +0800
+Subject: [PATCH] runc:do not support set umask through native.umask
+
+Signed-off-by: zhongjiawei <zhongjiawei1@huawei.com>
+---
+ libcontainer/rootfs_linux.go     | 6 ------
+ libcontainer/setns_init_linux.go | 6 ------
+ 2 files changed, 12 deletions(-)
+
+diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
+index c42e388..499d753 100644
+--- a/libcontainer/rootfs_linux.go
++++ b/libcontainer/rootfs_linux.go
+@@ -192,12 +192,6 @@ func finalizeRootfs(config *configs.Config) (err error) {
+ 	} else {
+ 		unix.Umask(0o022)
+ 	}
+-	umask := utils.SearchLabels(config.Labels, "native.umask")
+-	if umask == "normal" {
+-		unix.Umask(0o022)
+-	} else {
+-		unix.Umask(0o027)
+-	}
+ 	return nil
+ }
+ 
+diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
+index f1dcab6..d8cdfdf 100644
+--- a/libcontainer/setns_init_linux.go
++++ b/libcontainer/setns_init_linux.go
+@@ -56,12 +56,6 @@ func (l *linuxSetnsInit) Init() error {
+ 			return err
+ 		}
+ 	}
+-        umask := utils.SearchLabels(l.config.Config.Labels, "native.umask")
+-        if umask == "normal" {
+-                unix.Umask(0o022)
+-        } else {
+-                unix.Umask(0o027)
+-        }
+ 	if l.config.NoNewPrivileges {
+ 		if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+ 			return err
+-- 
+2.33.0
+

runc.spec

@@ -3,7 +3,7 @@
 
 Name: runc
 Version: 1.1.8
-Release: 18
+Release: 19
 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification.
 
 License: ASL 2.0
@@ -57,6 +57,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
 %{_bindir}/runc
 
 %changelog
+* Thu Jul 11 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.1.8-19
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:do not support set umask through native.umask
+
 * Wed Jun 19 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.1.8-18
 - Type:bugfix
 - CVE:NA

series.conf

@@ -39,3 +39,4 @@ patch/0039-runc-fix-CVE-2024-3154.patch
 patch/0040-add-loongarch64-seccomp-support.patch
 patch/0041-runc-Set-temporary-single-CPU-affinity-before-cgroup-cpus.patch
 patch/0042-runc-fix-a-data-race.patch
+patch/0043-runc-do-not-support-set-umask-through-native.umask.patch