docs: leave UMask out of the unit and say why (G5)

commit: 3f47b6d47d06355ec168abd9856a9db6085239c7
author: brice · 9d ago · 2026-10-12 19:48 UTC
parent: 01928f4
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +9 -3

M README.md +3 -2


@@ -158,7 +158,7 @@ loop mounts, the jailer, Docker), so the unit only takes away what it does not
158	158		use: `NoNewPrivileges`, `ProtectHome`, `PrivateTmp`, `ProtectClock`,
159	159		`ProtectKernelModules`, `ProtectKernelLogs`, `RestrictSUIDSGID`,
160	160		`LockPersonality`, `RestrictRealtime`, `SystemCallArchitectures=native`,
161		-	`RestrictAddressFamilies` (UNIX, INET, INET6, NETLINK, VSOCK) and `UMask=0077`.
	161	+	`RestrictAddressFamilies` (UNIX, INET, INET6, NETLINK, VSOCK).
162	162		Checked on a workstation (a user manager, no root): the micro-VM job test
163	163		(`TestVMRunsAJob`: user and network namespaces, Firecracker, TAP, vsock) passes
164	164		under every option above except `ProtectHome`, which hides the home directory

@@ -173,7 +173,8 @@ runner turns on `net.ipv4.ip_forward`), `PrivateDevices=` (`/dev/kvm`,
173	173		`CapabilityBoundingSet=` and `SystemCallFilter=` (network namespaces and
174	174		devices, mounts, capabilities handed to the jailer and Docker),
175	175		`MemoryDenyWriteExecute=` (Firecracker maps guest memory writable and
176		-	executable). The boundary of a job is its micro-VM or container, not this unit;
	176	+	executable), `UMask=` (the drivers create directories that the job's user must
	177	+	enter, with explicit modes; the state directory is made 0700 by the runner). The boundary of a job is its micro-VM or container, not this unit;
177	178		the unit cannot be tested end to end without a rootful host, so the options that
178	179		would only break it silently are left out.
179	180

 use: `NoNewPrivileges`, `ProtectHome`, `PrivateTmp`, `ProtectClock`,
 `ProtectKernelModules`, `ProtectKernelLogs`, `RestrictSUIDSGID`,
 `LockPersonality`, `RestrictRealtime`, `SystemCallArchitectures=native`,
-`RestrictAddressFamilies` (UNIX, INET, INET6, NETLINK, VSOCK) and `UMask=0077`.
+`RestrictAddressFamilies` (UNIX, INET, INET6, NETLINK, VSOCK).
 Checked on a workstation (a user manager, no root): the micro-VM job test
 (`TestVMRunsAJob`: user and network namespaces, Firecracker, TAP, vsock) passes
 under every option above except `ProtectHome`, which hides the home directory
 `CapabilityBoundingSet=` and `SystemCallFilter=` (network namespaces and
 devices, mounts, capabilities handed to the jailer and Docker),
 `MemoryDenyWriteExecute=` (Firecracker maps guest memory writable and
-executable). The boundary of a job is its micro-VM or container, not this unit;
+executable), `UMask=` (the drivers create directories that the job's user must
+enter, with explicit modes; the state directory is made 0700 by the runner). The boundary of a job is its micro-VM or container, not this unit;
 the unit cannot be tested end to end without a rootful host, so the options that
 would only break it silently are left out.

M contrib/ermite-runner.service +6 -1


@@ -38,7 +38,6 @@ TimeoutStopSec=120
38	38		StateDirectory=ermite-runner
39	39		StateDirectoryMode=0700
40	40		RuntimeDirectory=ermite-runner
41		-	UMask=0077
42	41
43	42		# Jobs are many processes.
44	43		TasksMax=infinity

@@ -96,3 +95,9 @@ WantedBy=multi-user.target
96	95		# boundary of a job is the micro-VM or the container, not
97	96		# this unit.
98	97		# ProtectControlGroups= The jailer writes the cgroups of the VMs.
	98	+	# UMask=0077 The state directory is made 0700 by the runner itself, and the
	99	+	# drivers create directories that the job's user must be able
	100	+	# to enter (the scratch disk's work and tmp directories are
	101	+	# made with mode 0755): a restrictive umask would turn them
	102	+	# into root-only directories, which cannot be tested without
	103	+	# a rootful host.

 StateDirectory=ermite-runner
 StateDirectoryMode=0700
 RuntimeDirectory=ermite-runner
-UMask=0077
 # Jobs are many processes.
 TasksMax=infinity
 #                     boundary of a job is the micro-VM or the container, not
 #                     this unit.
 # ProtectControlGroups=  The jailer writes the cgroups of the VMs.
+# UMask=0077          The state directory is made 0700 by the runner itself, and the
+#                     drivers create directories that the job's user must be able
+#                     to enter (the scratch disk's work and tmp directories are
+#                     made with mode 0755): a restrictive umask would turn them
+#                     into root-only directories, which cannot be tested without
+#                     a rootful host.