fix: disable chmod hook

cmd/nvidia-cdi-hook/README.md

@@ -26,7 +26,6 @@ on generating a CDI file.
 
 The `nvidia-cdi-hook` CLI provides the following functionality:
 
-* `chmod` - Change the permissions of a file or directory inside the directory path to be mounted into a container.
 * `create-symlinks` - Create symlinks inside the directory path to be mounted into a container.
 * `update-ldcache` - Update the dynamic linker cache inside the directory path to be mounted into a container.
 * `enable-cuda-compat` - Ensure that the directory containing the CUDA compat libraries is added to the ldconfig search path if required.

cmd/nvidia-cdi-hook/commands/commands.go

@@ -23,7 +23,6 @@ import (
 	"github.com/urfave/cli/v3"
 
 	cudamemorylimits "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/apply-cuda-memory-limits"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/chmod"
 	symlinks "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/create-symlinks"
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/cudacompat"
 	disabledevicenodemodification "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/disable-device-node-modification"
@@ -89,7 +88,6 @@ func ConfigureCDIHookCommand(logger logger.Interface, base *cli.Command) *cli.Co
 	base.Commands = []*cli.Command{
 		ldcache.NewCommand(logger),
 		symlinks.NewCommand(logger),
-		chmod.NewCommand(logger),
 		cudacompat.NewCommand(logger),
 		disabledevicenodemodification.NewCommand(logger),
 		cudamemorylimits.NewCommand(logger),

cmd/nvidia-ctk/cdi/generate/generate_test.go

@@ -478,91 +478,6 @@ containerEdits:
             - nodev
             - rbind
             - rprivate
-`,
-		},
-		{
-			description: "enableChmodHook",
-			options: options{
-				format:        "yaml",
-				mode:          "management",
-				vendor:        "example.com",
-				class:         "device",
-				driverRoot:    driverRoot,
-				enabledHooks:  []string{"chmod"},
-				disabledHooks: []string{"enable-cuda-compat", "update-ldcache", "disable-device-node-modification"},
-			},
-			expectedOptions: options{
-				format:            "yaml",
-				mode:              "management",
-				vendor:            "example.com",
-				class:             "device",
-				nvidiaCDIHookPath: "/usr/bin/nvidia-cdi-hook",
-				driverRoot:        driverRoot,
-				enabledHooks:      []string{"chmod"},
-				disabledHooks:     []string{"enable-cuda-compat", "update-ldcache", "disable-device-node-modification"},
-			},
-			expectedSpec: `---
-cdiVersion: 0.5.0
-kind: example.com/device
-devices:
-    - name: all
-      containerEdits:
-        deviceNodes:
-            - path: /dev/nvidia0
-              hostPath: {{ .driverRoot }}/dev/nvidia0
-            - path: /dev/nvidiactl
-              hostPath: {{ .driverRoot }}/dev/nvidiactl
-            - path: /dev/nvidia-caps-imex-channels/channel0
-              hostPath: {{ .driverRoot }}/dev/nvidia-caps-imex-channels/channel0
-            - path: /dev/nvidia-caps-imex-channels/channel1
-              hostPath: {{ .driverRoot }}/dev/nvidia-caps-imex-channels/channel1
-            - path: /dev/nvidia-caps-imex-channels/channel2047
-              hostPath: {{ .driverRoot }}/dev/nvidia-caps-imex-channels/channel2047
-            - path: /dev/nvidia-caps/nvidia-cap1
-              hostPath: {{ .driverRoot }}/dev/nvidia-caps/nvidia-cap1
-        hooks:
-            - hookName: createContainer
-              path: /usr/bin/nvidia-cdi-hook
-              args:
-                - nvidia-cdi-hook
-                - chmod
-                - --mode
-                - "755"
-                - --path
-                - /dev/nvidia-caps
-              env:
-                - NVIDIA_CTK_DEBUG=false
-containerEdits:
-    env:
-        - NVIDIA_CTK_LIBCUDA_DIR=/lib/x86_64-linux-gnu
-        - NVIDIA_VISIBLE_DEVICES=void
-    hooks:
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - create-symlinks
-            - --link
-            - libcuda.so.1::/lib/x86_64-linux-gnu/libcuda.so
-          env:
-            - NVIDIA_CTK_DEBUG=false
-    mounts:
-        - hostPath: {{ .driverRoot }}/lib/x86_64-linux-gnu/libcuda.so.999.88.77
-          containerPath: /lib/x86_64-linux-gnu/libcuda.so.999.88.77
-          options:
-            - ro
-            - nosuid
-            - nodev
-            - rbind
-            - rprivate
-        - hostPath: {{ .driverRoot }}/lib/x86_64-linux-gnu/vdpau/libvdpau_nvidia.so.999.88.77
-          containerPath: /lib/x86_64-linux-gnu/vdpau/libvdpau_nvidia.so.999.88.77
-          options:
-            - ro
-            - nosuid
-            - nodev
-            - rbind
-            - rprivate
 `,
 		},
 	}

internal/discover/hooks.go

@@ -46,10 +46,6 @@ const (
 	// profiles". It currently restricts EGL/Vulkan GPU visibility inside the
 	// container to the GPUs actually mounted.
 	ApplicationProfileHook = HookName("update-application-profile")
-	// A ChmodHook is used to set the file mode of the specified paths.
-	//
-	// Deprecated: The chmod hook is deprecated and will be removed in a future release.
-	ChmodHook = HookName("chmod")
 	// A CreateSymlinksHook is used to create symlinks in the container.
 	CreateSymlinksHook = HookName("create-symlinks")
 	// DisableDeviceNodeModificationHook refers to the hook used to ensure that
@@ -69,14 +65,6 @@ const (
 	defaultNvidiaCDIHookPath = "/usr/bin/nvidia-cdi-hook"
 )
 
-// defaultDisabledHooks defines hooks that are disabled by default.
-// These hooks can be explicitly enabled using the WithEnabledHooks option.
-var defaultDisabledHooks = []HookName{
-	// ChmodHook is disabled by default as it was a workaround for older
-	// versions of crun that has since been fixed.
-	ChmodHook,
-}
-
 var _ Discover = (*Hook)(nil)
 
 // Devices returns an empty list of devices for a Hook discoverer.
@@ -151,7 +139,7 @@ func WithDisabledHooks(hooks ...HookName) Option {
 }
 
 // WithEnabledHooks explicitly enables the specified hooks.
-// This is useful for enabling hooks that are disabled by default.
+// This is useful for overriding hooks passed to WithDisabledHooks.
 func WithEnabledHooks(hooks ...HookName) Option {
 	return func(c *hookCreatorOptions) {
 		c.enabledHooks = append(c.enabledHooks, hooks...)
@@ -179,8 +167,6 @@ func NewHookCreator(opts ...Option) HookCreator {
 		opt(o)
 	}
 
-	o.disabledHooks = append(o.disabledHooks, defaultDisabledHooks...)
-
 	disabledHooks := make(map[HookName]bool)
 	for _, h := range o.disabledHooks {
 		disabledHooks[h] = true
@@ -222,7 +208,7 @@ func (c cdiHookCreator) Create(name HookName, args ...string) *Hook {
 
 func (c cdiHookCreator) getOCIHookType(name HookName) OCIHookType {
 	switch name {
-	case CreateSymlinksHook, ChmodHook, DisableDeviceNodeModificationHook, EnableCudaCompatHook, UpdateLDCacheHook, ApplicationProfileHook:
+	case CreateSymlinksHook, DisableDeviceNodeModificationHook, EnableCudaCompatHook, UpdateLDCacheHook, ApplicationProfileHook:
 		return OCIHookTypeCreateContainer
 	case ApplyCudaMemoryLimitsHook:
 		return OCIHookTypeCreateRuntime
@@ -242,7 +228,7 @@ func (c cdiHookCreator) isDisabled(name HookName, args ...string) bool {
 
 	// still reject hooks that require args if none were provided
 	switch name {
-	case CreateSymlinksHook, ChmodHook, ApplyCudaMemoryLimitsHook:
+	case CreateSymlinksHook, ApplyCudaMemoryLimitsHook:
 		return len(args) == 0
 	}
 	return false
@@ -259,11 +245,6 @@ func (c cdiHookCreator) transformArgs(name HookName, args ...string) []string {
 		for _, arg := range args {
 			transformedArgs = append(transformedArgs, "--link", arg)
 		}
-	case ChmodHook:
-		transformedArgs = append(transformedArgs, "--mode", "755")
-		for _, arg := range args {
-			transformedArgs = append(transformedArgs, "--path", arg)
-		}
 	case UpdateLDCacheHook:
 		if c.ldconfigPath != "" {
 			transformedArgs = append(transformedArgs, "--ldconfig-path", c.ldconfigPath)