diff --git a/docs/source/markdown/podman-systemd.unit.5.md b/docs/source/markdown/podman-systemd.unit.5.md index 6486770962..3574cf9f3f 100644 --- a/docs/source/markdown/podman-systemd.unit.5.md +++ b/docs/source/markdown/podman-systemd.unit.5.md @@ -352,6 +352,7 @@ Valid options for `[Container]` are listed below: | Tmpfs=/work | --tmpfs /work | | UIDMap=0:10000:10 | --uidmap=0:10000:10 | | Ulimit=nofile=1000:10000 | --ulimit nofile=1000:10000 | +| Umask=0002 | --umask=0002 | | Unmask=ALL | --security-opt unmask=ALL | | User=bin | --user bin | | UserNS=keep-id:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | @@ -899,6 +900,15 @@ Ulimit options. Sets the ulimits values inside of the container. This key can be listed multiple times. +### `Umask=` + +Set the umask of the process. This is equivalent to the Podman `--umask`. + +Example: +``` +Umask=0002 +``` + ### `Unmask=` Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*): diff --git a/pkg/systemd/quadlet/quadlet.go b/pkg/systemd/quadlet/quadlet.go index fc43c7ea80..cb0f1aee48 100644 --- a/pkg/systemd/quadlet/quadlet.go +++ b/pkg/systemd/quadlet/quadlet.go @@ -169,6 +169,7 @@ const ( KeyType = "Type" KeyUIDMap = "UIDMap" KeyUlimit = "Ulimit" + KeyUmask = "Umask" KeyUnmask = "Unmask" KeyUser = "User" KeyUserNS = "UserNS" @@ -279,6 +280,7 @@ var ( KeyTmpfs: true, KeyUIDMap: true, KeyUlimit: true, + KeyUmask: true, KeyUnmask: true, KeyUser: true, KeyUserNS: true, @@ -638,6 +640,7 @@ func ConvertContainer(container *parser.UnitFile, isUser bool, unitsInfoMap map[ KeyStopTimeout: "--stop-timeout", KeyPull: "--pull", KeyMemory: "--memory", + KeyUmask: "--umask", } lookupAndAddString(container, ContainerGroup, stringKeys, podman) diff --git a/test/e2e/quadlet/umask.container b/test/e2e/quadlet/umask.container new file mode 100644 index 0000000000..8f01bfffc2 --- /dev/null +++ b/test/e2e/quadlet/umask.container @@ -0,0 +1,5 @@ +## assert-podman-args "--umask" "0002" + +[Container] +Image=localhost/imagename +Umask=0002 diff --git a/test/e2e/quadlet_test.go b/test/e2e/quadlet_test.go index 2d840c4ac7..ddb2bf6d8c 100644 --- a/test/e2e/quadlet_test.go +++ b/test/e2e/quadlet_test.go @@ -911,6 +911,7 @@ BOGUS=foo Entry("sysctl.container", "sysctl.container"), Entry("timezone.container", "timezone.container"), Entry("ulimit.container", "ulimit.container"), + Entry("umask.container", "umask.container"), Entry("unmask.container", "unmask.container"), Entry("user.container", "user.container"), Entry("userns.container", "userns.container"),