'permission denied' error with umask 007

runc fails to run in the situation when umask is 007 and user is not privileged.

Steps to reproduce:

 1. change umask to 007
 2. modify the user ID and group ID in config.json to be non root
 3. sudo runc run

You should see error message like:

panic: standard_init_linux.go:164: openat exec fifo caused "permission denied" [recovered]
	panic: standard_init_linux.go:164: openat exec fifo caused "permission denied"

goroutine 1 [running, locked to thread]:
panic(0x7e7900, 0xc82004fc00)
	/usr/local/go/src/runtime/panic.go:464 +0x3e6
github.com/urfave/cli.HandleAction.func1(0xc8200b9310)
	/home/vagrant/git/test_release/runc-1.0.0-rc2/Godeps/_workspace/src/github.com/urfave/cli/app.go:478 +0x38e
panic(0x7e7900, 0xc82004fc00)
	/usr/local/go/src/runtime/panic.go:426 +0x4e9
github.com/opencontainers/runc/libcontainer.(*LinuxFactory).StartInitialization.func1(0xc8200b8c20, 0xc82001e078, 0xc8200b8d30)
	/home/vagrant/git/test_release/runc-1.0.0-rc2/Godeps/_workspace/src/github.com/opencontainers/runc/libcontainer/factory_linux.go:259 +0x136
github.com/opencontainers/runc/libcontainer.(*LinuxFactory).StartInitialization(0xc820068730, 0x7f11a0ef43d0, 0xc82004fc00)
	/home/vagrant/git/test_release/runc-1.0.0-rc2/Godeps/_workspace/src/github.com/opencontainers/runc/libcontainer/factory_linux.go:277 +0x5b1
main.glob.func8(0xc82008a780, 0x0, 0x0)
	/home/vagrant/git/test_release/runc-1.0.0-rc2/main_unix.go:26 +0x68
reflect.Value.call(0x74c6c0, 0x8fd428, 0x13, 0x843f30, 0x4, 0xc8200b9290, 0x1, 0x1, 0x0, 0x0, ...)
	/usr/local/go/src/reflect/value.go:435 +0x120d
reflect.Value.Call(0x74c6c0, 0x8fd428, 0x13, 0xc8200b9290, 0x1, 0x1, 0x0, 0x0, 0x0)
	/usr/local/go/src/reflect/value.go:303 +0xb1
github.com/urfave/cli.HandleAction(0x74c6c0, 0x8fd428, 0xc82008a780, 0x0, 0x0)
	/home/vagrant/git/test_release/runc-1.0.0-rc2/Godeps/_workspace/src/github.com/urfave/cli/app.go:487 +0x2ee
github.com/urfave/cli.Command.Run(0x846de8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dc8e0, 0x51, 0x0, ...)
	/home/vagrant/git/test_release/runc-1.0.0-rc2/Godeps/_workspace/src/github.com/urfave/cli/command.go:191 +0xfec
github.com/urfave/cli.(*App).Run(0xc820001980, 0xc82000a100, 0x2, 0x2, 0x0, 0x0)
	/home/vagrant/git/test_release/runc-1.0.0-rc2/Godeps/_workspace/src/github.com/urfave/cli/app.go:240 +0xaa4
main.main()
	/home/vagrant/git/test_release/runc-1.0.0-rc2/main.go:132 +0xd98

And the process hangs so you have to kill runC process.
The reason of the failure is the container directory in /run/runc is created with drwx--x--- permission and owned by root, so the non-previllged user effectively cannot read anything from there.

This problem goes away with umask 022. So actually all we need to do is to guarantee the umask to allow the necessary permission before starting libcontainer unless it is unsafe.

Start by reproducing the umask 007 case and reading libcontainer/factory_linux.go around StartInitialization, with the reported permission behavior in /run/runc as context. Check the related startup path in main_unix.go; done means an unprivileged configured user can start the container without a permission-denied panic or hang, while unsafe permissions are not weakened.