Skip to content

Commit 0d5f0e9

Browse files
leofangleofang
committed
CI: preserve SUID bit when refreshing container nvidia binaries
refresh_container_libs() used 'cp -f --remove-destination' (verbatim from the runner team's nvgha-driver), which without -p/--preserve strips the SUID/SGID bits on the destination. /usr/bin/nvidia-modprobe ships 4755 and NVML's state-changing calls (e.g. nvmlDeviceSetPersistenceMode) route through it; once SUID is gone the container-side call returns NVML_ERROR_UNKNOWN, which is what cuda.core's test_persistence_mode_enabled was hitting. Add a stat diagnostic line at the end of refresh_container_libs() so the next CI log records nvidia-modprobe's post-refresh mode.
1 parent 00896dc commit 0d5f0e9

1 file changed

Lines changed: 12 additions & 1 deletion

File tree

‎ci/tools/install_gpu_driver.sh‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,10 +167,21 @@ refresh_container_libs() {
167167
[ -n "$src" ] || { echo "skip $tgt: no host source" >&2; continue; }
168168
fi
169169
umount "$tgt" 2>/dev/null || true
170-
cp -f --remove-destination "$src" "$tgt" \
170+
# --preserve=mode keeps the SUID bit. /usr/bin/nvidia-modprobe ships
171+
# 4755 and NVML's state-changing calls (e.g.
172+
# nvmlDeviceSetPersistenceMode) go through it; a plain `cp` strips
173+
# SUID and the call then fails with NVML_ERROR_UNKNOWN. The runner
174+
# team's nvgha-driver has the same bug; we differ here.
175+
cp -f --preserve=mode --remove-destination "$src" "$tgt" \
171176
|| echo "WARN: refresh failed for $tgt (src=$src)" >&2
172177
done
173178
ldconfig
179+
180+
# Diagnostic: confirm SUID survived on nvidia-modprobe (the load-bearing
181+
# piece). One-liner so the next CI log proves the fix.
182+
if [ -e /usr/bin/nvidia-modprobe ]; then
183+
stat -c 'refresh: %n mode=%a uid=%u' /usr/bin/nvidia-modprobe >&2
184+
fi
174185
}
175186

176187
if [ -z "${_NVDRV_NSENTERED:-}" ] && in_container; then

0 commit comments

Comments
 (0)