Merge pull request #2356 from crazy-max/git-umask

Standard user umask for git process

cmd/buildkitd/main.go

@@ -74,7 +74,9 @@ func init() {
 	stack.SetVersionInfo(version.Version, version.Revision)
 
 	seed.WithTimeAndRand()
-	reexec.Init()
+	if reexec.Init() {
+		os.Exit(0)
+	}
 
 	// overwrites containerd/log.G
 	log.G = bklog.GetLogger

source/git/gitsource_test.go

@@ -15,6 +15,7 @@ import (
 	"github.com/containerd/containerd/namespaces"
 	"github.com/containerd/containerd/snapshots"
 	"github.com/containerd/containerd/snapshots/native"
+	"github.com/docker/docker/pkg/reexec"
 	"github.com/moby/buildkit/cache"
 	"github.com/moby/buildkit/cache/metadata"
 	"github.com/moby/buildkit/snapshot"
@@ -27,6 +28,12 @@ import (
 	bolt "go.etcd.io/bbolt"
 )
 
+func init() {
+	if reexec.Init() {
+		os.Exit(0)
+	}
+}
+
 func TestRepeatedFetch(t *testing.T) {
 	testRepeatedFetch(t, false)
 }

source/git/gitsource_unix.go

@@ -4,13 +4,75 @@ package git
 
 import (
 	"context"
+	"os"
 	"os/exec"
-	"syscall"
+	"os/signal"
 	"time"
+
+	"github.com/docker/docker/pkg/reexec"
+	"golang.org/x/sys/unix"
 )
 
+const (
+	gitCmd = "umask-git"
+)
+
+func init() {
+	reexec.Register(gitCmd, gitMain)
+}
+
+func gitMain() {
+	// Need standard user umask for git process.
+	unix.Umask(0022)
+
+	// Reexec git command
+	cmd := exec.Command(os.Args[1], os.Args[2:]...)
+	cmd.SysProcAttr = &unix.SysProcAttr{
+		Setpgid:   true,
+		Pdeathsig: unix.SIGTERM,
+	}
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Stdin = os.Stdin
+
+	// Forward all signals
+	sigc := make(chan os.Signal, 1)
+	done := make(chan struct{})
+	signal.Notify(sigc)
+	go func() {
+		for {
+			select {
+			case sig := <-sigc:
+				if cmd.Process == nil {
+					continue
+				}
+				switch sig {
+				case unix.SIGINT, unix.SIGTERM, unix.SIGKILL:
+					_ = unix.Kill(-cmd.Process.Pid, sig.(unix.Signal))
+				default:
+					_ = cmd.Process.Signal(sig)
+				}
+			case <-done:
+				return
+			}
+		}
+	}()
+
+	err := cmd.Run()
+	close(done)
+	if err != nil {
+		if exiterr, ok := err.(*exec.ExitError); ok {
+			status := exiterr.Sys().(unix.WaitStatus)
+			os.Exit(status.ExitStatus())
+		}
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
 func runProcessGroup(ctx context.Context, cmd *exec.Cmd) error {
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Path = reexec.Self()
+	cmd.Args = append([]string{gitCmd}, cmd.Args...)
 	if err := cmd.Start(); err != nil {
 		return err
 	}
@@ -18,12 +80,12 @@ func runProcessGroup(ctx context.Context, cmd *exec.Cmd) error {
 	go func() {
 		select {
 		case <-ctx.Done():
-			syscall.Kill(-cmd.Process.Pid, syscall.SIGTERM)
+			_ = unix.Kill(-cmd.Process.Pid, unix.SIGTERM)
 			go func() {
 				select {
 				case <-waitDone:
 				case <-time.After(10 * time.Second):
-					syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+					_ = unix.Kill(-cmd.Process.Pid, unix.SIGKILL)
 				}
 			}()
 		case <-waitDone: