Copy --chmod ignores suid flag

[MrQubo]

Minimal example:

# touch file && docker run --rm -it $(docker build -q .) ls -l /example
FROM ubuntu:22.04

COPY --chmod=4555 file /example/

The permissions of file are -r-xr-xr-x instead of -r-sr-xr-x.
Compare with this working version:

# touch file && docker run --rm -it $(docker build -q .) ls -l /example
FROM ubuntu:22.04

COPY file /example/
RUN chmod 4555 /example/file

Environment

$ docker version
Client:
 Version:           24.0.0
 API version:       1.43
 Go version:        go1.20.4
 Git commit:        98fdcd769b
 Built:             Thu May 18 09:55:36 2023
 OS/Arch:           linux/amd64
 Context:           default

Server:
 Engine:
  Version:          24.0.0
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.4
  Git commit:       1331b8c39a
  Built:            Thu May 18 09:55:36 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v1.7.1
  GitCommit:        1677a17964311325ed1c31e2c0a3589ce6d5c30d.m
 runc:
  Version:          1.1.7
  GitCommit:
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

[musaprg]

I also faced the same issue. I briefly looked into the code and figured out that one of the dependent modules called tonistiigi/fsutil doesn't handle the special octet such as SUID, SGID, and sticky bit specified in --chmod. SUID/SGID flags specified in the original file are respected, however, those specified in --chmod are totally ignored.

[musaprg]

Let me prepare a PR, but I'm not confident if it came from some security reasons.

[musaprg]

@MrQubo Hi. JFYI, the patch was merged by #4683 and shipped in v0.13.0.

[MrQubo]

Thank you. I appreciate your work on that!