CDI spec file gets created with 600 access

[tkatila]

We have written a CDI spec generator tool for Intel GPUs. When using it, I noticed that even though the directory for the CDI specs is created with 755, the files themselves are created with 600. We are using cache's WriteSpec function. This has the downside that docker or podman has to be executed with sudo/root so it can read the CDI specs. As the CDI specs typically reside in root access directories (/etc, /var/run), executing the generator without sudo isn't possible.

For non-root use, I believe the CDI specs should be readable by all.

[elezar]

We use the following logic to ensure that the spec is world-readable: https://github.com/NVIDIA/nvidia-container-toolkit/blob/f959c0daaa30e7079458e550ed867cd4faf4a102/pkg/nvcdi/spec/spec.go#L67-L69

It may be useful to consider using something like renameio though to ensure atomic writes: https://github.com/NVIDIA/k8s-device-plugin/blob/c181c46f5fdeb367f16c5f9ab8be83c3ae60a90e/internal/lm/output.go#L90

[github-actions[bot]]

This issue is stale because it has been open 90 days with no activity. This issue will be closed in 30 days unless new comments are made or the stale label is removed. To skip these checks, apply the "lifecycle/frozen" label.

[github-actions[bot]]

This issue was automatically closed due to inactivity.