From d77f46aa09f8f675ebb9e998cc528bf07dbdd83a Mon Sep 17 00:00:00 2001 From: Evan Lezar Date: Fri, 28 Apr 2023 13:40:06 +0200 Subject: [PATCH] Create ld.so.conf file with permissions 644 By default, temporary files are created with permissions 600 and this means that the files created when updating the ldcache are not readable in non-root containers. Signed-off-by: Evan Lezar --- CHANGELOG.md | 1 + cmd/nvidia-ctk/hook/update-ldcache/update-ldcache.go | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f5b7dbff..757130f1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## v1.14.0-rc.1 * Add support for updating containerd configs to the `nvidia-ctk runtime configure` command. +* Create file in `etc/ld.so.conf.d` with permissions `644` to support non-root containers. ## v1.13.1 diff --git a/cmd/nvidia-ctk/hook/update-ldcache/update-ldcache.go b/cmd/nvidia-ctk/hook/update-ldcache/update-ldcache.go index 4ced4f89..119573e6 100644 --- a/cmd/nvidia-ctk/hook/update-ldcache/update-ldcache.go +++ b/cmd/nvidia-ctk/hook/update-ldcache/update-ldcache.go @@ -135,5 +135,10 @@ func (m command) createConfig(root string, folders []string) error { configured[folder] = true } + // The created file needs to be world readable for the cases where the container is run as a non-root user. + if err := os.Chmod(configFile.Name(), 0644); err != nil { + return fmt.Errorf("failed to chmod config file: %v", err) + } + return nil }