Change the permission of overlay dir to and generated overlays to

Signed-off-by: xu yang <xyang@ciq.com>

CHANGELOG.md

@@ -64,6 +64,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 - Interleave tmpfs across all available NUMA nodes. #1347, #1348
 - Syncuser watches for changes in mtime rather than ctime. #1358
+- Change the default permissions for provisioned overlay images to `0750` (dirs) and `0660` (files). #1388
 
 ### Fixed
 

internal/pkg/overlay/overlay.go

@@ -136,7 +136,7 @@ func BuildOverlay(nodeInfo node.NodeInfo, context string, overlayNames []string)
 	overlayImage := OverlayImage(nodeInfo.Id.Get(), context, overlayNames)
 	overlayImageDir := path.Dir(overlayImage)
 
-	err := os.MkdirAll(overlayImageDir, 0755)
+	err := os.MkdirAll(overlayImageDir, 0750)
 	if err != nil {
 		return errors.Wrapf(err, "Failed to create directory for %s: %s", name, overlayImageDir)
 	}

internal/pkg/util/util.go

@@ -543,6 +543,9 @@ func CpioCreate(
 
 	args = append(args, cpio_args...)
 
+	oldMask := syscall.Umask(007)
+	defer syscall.Umask(oldMask)
+
 	proc := exec.Command("cpio", args...)
 
 	stdin, err := proc.StdinPipe()