Add umask option to system config with validation and worker support

[abishek003-tech]

Title:

feat(system): add umask option to system config with validation and documentation

Summary

This PR adds support for a umask option in the configuration block of Fluentd.
Previously, users could only set umask via the command-line flag --umask, which was inconvenient for services and containerized deployments.

Example usage in fluent.conf:

umask 0022

Motivation

Allow users to set default file permission masks without using CLI flags.

Ensure multi-worker mode also respects the configured umask.

Improve usability for production deployments and containerized environments.

Changes

Added config_param :umask, :string, default: nil to SystemConfig.

Implemented apply_umask method:

Parses octal values (0022, 0077, etc.)

Validates range (000–777)

Logs applied umask or warnings for invalid values

Sets process umask early during startup, before worker spawn

Updated tests to cover:

Valid umask

Invalid values

Out-of-range values

Added documentation in docs/configuration/system.md.

Bug Fixes / Improvements

Fixes issue where umask previously only worked in standalone mode.

Adds logging for visibility of applied umask.

Gracefully handles invalid input without crashing Fluentd.

Ensures umask affects all files created by Fluentd (logs, buffer, pos files).

Testing

Manual test:

Add umask 0077 in fluent.conf.

Start Fluentd: bin/fluentd -c fluent.conf.

Observe logs: System umask changed from … to 0077.

Verify file creation permissions reflect the umask.

Unit tests added to test/config/test_system_config.rb:

Valid umask

Invalid string umask

Out-of-range umask

[daipom]

Related:

• System config: add umask option #4816

[daipom]

Thanks!
We need to fix Fluentd’s startup process, instead of adding SystemConfig#apply().

fluentd/lib/fluent/supervisor.rb

Line 806 in 35f390c

@system_config = build_system_config(@conf)

This merges the options of system_config with those of the command line.

It would be necessary to replace the following values with @system_config.umask

fluentd/lib/fluent/supervisor.rb

Line 945 in 35f390c

'chumask' => @chumask,

fluentd/lib/fluent/supervisor.rb

Line 777 in 35f390c

File.umask(@chumask.to_i(8))

Note: Maybe we need another fix for Docker images (#4816 (comment)), but it would be something to address in the future.