mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Evan Lezar
d154dd7b99
Resolve the selected CDI devices against the spec directories projected into the workload and derive the filesystem requirements their edits imply: - device nodes, which need read-write access; - read-only mounts, expanded to the parent directory for shared libraries; - Unix sockets, kept as exact targets without filesystem grants; - the NVIDIA MPS pipe directory, accepted as a writable IPC directory only when mounted nosuid, nodev and noexec; - additional GIDs, excluding root. Effective mount access comes from the workload's mount table rather than spec options. Ordinary writable mounts, broad roots and conflicting uses of one path are rejected. Captured Orin, Spark and multi-GPU specs drive the production resolver against reviewed baselines. The resolver is wired into launch in the next commit. Signed-off-by: Evan Lezar <elezar@nvidia.com>