-
Notifications
You must be signed in to change notification settings - Fork 309
Merge V1.83.0 into Develop #5313
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
0708266
e790113
c8fa496
80f0b3b
cab05f9
44196de
8f655b4
8eb5de0
09301db
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -16,4 +16,22 @@ | |||||||||||||||||||||||||
| # This creates a file named "nvidia+pytorch+24.09-py3.sqsh", which | ||||||||||||||||||||||||||
| # uses ~18 GB of disk space. This should be run on a filesystem that | ||||||||||||||||||||||||||
| # can be seen by all worker nodes | ||||||||||||||||||||||||||
| enroot import docker://nvcr.io#nvidia/pytorch:24.09-py3 | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # Fix for non-interactive shells where XDG_RUNTIME_DIR is not set | ||||||||||||||||||||||||||
| if [ -z "$XDG_RUNTIME_DIR" ]; then | ||||||||||||||||||||||||||
| # Try creating a user-specific directory in /run (often fails for non-root) | ||||||||||||||||||||||||||
| XDG_RUNTIME_DIR="/run/user/$(id -u)" | ||||||||||||||||||||||||||
| export XDG_RUNTIME_DIR | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # Check if we can actually use it | ||||||||||||||||||||||||||
| if [ ! -d "$XDG_RUNTIME_DIR" ]; then | ||||||||||||||||||||||||||
| # Fallback to a guaranteed writable location in /tmp | ||||||||||||||||||||||||||
| XDG_RUNTIME_DIR="/tmp/enroot-runtime-$(id -u)" | ||||||||||||||||||||||||||
| export XDG_RUNTIME_DIR | ||||||||||||||||||||||||||
| mkdir -p "$XDG_RUNTIME_DIR" | ||||||||||||||||||||||||||
| chmod 700 "$XDG_RUNTIME_DIR" | ||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||
|
Comment on lines
+27
to
+33
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The script creates a temporary directory in
Suggested change
References
|
||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # Import the pytorch container | ||||||||||||||||||||||||||
| enroot import "docker://nvcr.io#nvidia/pytorch:24.09-py3" | ||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The script creates a temporary directory in
/tmpusing a predictable name based on the user's UID, which is insecure and vulnerable to symlink attacks in a multi-user environment. An attacker could pre-create this directory with insecure permissions to intercept or interfere with theenroot importprocess. Additionally, the script lacksset -e, meaning it will continue to execute even ifchmod 700fails. It is recommended to usemktemp -dfor secure and unique directory creation.References
/tmpwith predictable names and world-writable permissions, especially withsudo, as this is vulnerable to symlink attacks. Prefer usingmktemp -dfor secure temporary directory creation, or usemkdirwith restrictive permissions (e.g.,700) and withoutsudo.