search

cncf-tags / container-device-interface

Apache License 2.0
200 stars 37 forks source link

CDI spec file gets created with 600 access #224

Open tkatila opened 4 weeks ago

tkatila commented 4 weeks ago

We have written a CDI spec generator tool for Intel GPUs. When using it, I noticed that even though the directory for the CDI specs is created with 755, the files themselves are created with 600. We are using cache's WriteSpec function. This has the downside that docker or podman has to be executed with sudo/root so it can read the CDI specs. As the CDI specs typically reside in root access directories (/etc, /var/run), executing the generator without sudo isn't possible.

For non-root use, I believe the CDI specs should be readable by all.

elezar commented 2 weeks ago

We use the following logic to ensure that the spec is world-readable: https://github.com/NVIDIA/nvidia-container-toolkit/blob/f959c0daaa30e7079458e550ed867cd4faf4a102/pkg/nvcdi/spec/spec.go#L67-L69

It may be useful to consider using something like renameio though to ensure atomic writes: https://github.com/NVIDIA/k8s-device-plugin/blob/c181c46f5fdeb367f16c5f9ab8be83c3ae60a90e/internal/lm/output.go#L90