Creating a self-contained executable with dotnet publish -r ignores umask and marks libraries as executable (chmod +x)

Steps to reproduce

umask 0022
dotnet publish -r linux-x64 -o test-publish

Expected behavior

1. The libraries copied to the publish output directories are not executable (don’t have the +x mode set). Only executable files (e.g. createdump and the project executable) have +x set.
2. File permissions follow the user’s umask. E.g.

-rwxr-xr-x 1 root root 82152 Jun 14 2018 createdump* -rw-r–r-- 1 root root 221184 Mar 8 2017 log4net.dll* -rw-r–r-- 1 root root 6656 Jun 14 2018 System.Security.dll*

Actual behavior

1. Both .NET Core runtime and NuGet package DLLs and .so files are executable.
2. All these files are also other-writable. Eg.

-rwxrw-rw- 1 root root 82152 Jun 14 2018 createdump* -rwxrw-rw- 1 root root 221184 Mar 8 2017 log4net.dll* -rwxrw-rw- 1 root root 6656 Jun 14 2018 System.Security.dll*

Environment data

dotnet --info output:

.NET Core SDK (reflecting any global.json):
 Version:   2.1.504
 Commit:    91e160c7f0

Runtime Environment:
 OS Name:     ubuntu
 OS Version:  18.04
 OS Platform: Linux
 RID:         ubuntu.18.04-x64
 Base Path:   /usr/share/dotnet/sdk/2.1.504/

Host (useful for support):
  Version: 2.1.8
  Commit:  209f8aa25c

.NET Core SDKs installed:
  2.1.504 [/usr/share/dotnet/sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.8 [/usr/share/dotnet/shared/Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.8 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.8 [/usr/share/dotnet/shared/Microsoft.NETCore.App]

To install additional .NET Core runtimes or SDKs:
  https://aka.ms/dotnet-download

[nguerrera]

Another implementation detail is leaking with the exe, it is copied from nuget (starts as apphost) and then it is modified to bind to the app dll.

I believe the nuget issue may be https://github.com/NuGet/Home/issues/7673, which was just fixed. cc @rrelyea

[peterhuene]

The issue of them being u+x in the first place is a dupe of https://github.com/NuGet/Home/issues/6778. I would expect a permission of 644 or 666 (if they really need to be writable) for unpacked files from NuGet that aren’t directly executable.

Regarding the umask issue, that sounds like a CoreFX issue to me, given that we’re using a MSBuild Copy task and it’s calling File.Copy under the covers, which appears to be a permission-preserving copy.