File permissions can't have full accesss

[The-LittleTeapot]

Describe the bug

Unable to set

file_permission 777

Files are created as 755 due to umask.

To Reproduce

add to config:

file_permission 777

Expected behavior

files should be created with full permissions

Your Environment

- Fluentd version: v1.16.6-debian-1.0
- Operating system:GNU/Linux
- Kernel version:3.10.0-1160.76.1.el7.x86_64

Your Configuration

<system>
  file_permission 777
</system>

<source>
  @type forward
  port 24224
  bind 0.0.0.0
</source>

<match **>
  @type copy
  
  <store>
  @type file
    path /app/log/webui-testing/webui-debug-log3
    append true
    format out_file
    <buffer>
      path /app/buffer/webui/webui-debug-buffer
      flush_interval 5s
      flush_mode interval
      chunk_limit_size 512m
      total_limit_size 1g
      overflow_action block
      @type file
    </buffer>
  </store>
</match>

Your Error Log

NO error message,

Files are created with r-x permissions (755) due to the default umask.

Additional context

If changing the permissions is not possible how can we change the default umask?

[daipom]

Fluentd has --umask command line option.

• https://docs.fluentd.org/deployment/command-line-option

However, we cannot set this in system_config.
We should add this setting to system_config.

[daipom]

For docker images, we can change this in ENTRYPOINT.

https://github.com/fluent/fluentd-docker-image/blob/89d5c78641633b5ea8acff6958f484ef75c45160/v1.18/debian/Dockerfile#L64

Example:

ENTRYPOINT ["tini",  "--", "/bin/entrypoint.sh", "--umask", "0000"]

[daipom]

Sorry. There are some limitations for --umask.
It would not work for Fluentd Docker images.

• Fluentd v1.14.6 ~ v1.18.0: --umask works only when using --no-supervisor.
  • This will be fixed in chumask: fix issue where it only works with standalone worker #4836.
• However, even if that PR is merged, it would not work for Fluentd Docker images.
  • In ServerEngine, it appears that the umask value is applied only when using daemonize.
  • So, it would work for fluent-package, but not for Docker images.

I wonder why ServerEngine has such specifications.
Is there any reason why an application should not change umask if it does not run as a daemon?
If there is no particular reason, then we could fix ServerEngine to solve this issue.

Or is it possible to change umask on the container environment?