From fa9163e7a046bf18197003f8b54ef89c9d56c796 Mon Sep 17 00:00:00 2001 From: Lucas Manning Date: Tue, 1 Aug 2023 13:54:20 -0700 Subject: [PATCH] Bind mount PCI paths for TPUs as read only. PiperOrigin-RevId: 552912189 --- runsc/cmd/chroot.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/runsc/cmd/chroot.go b/runsc/cmd/chroot.go index 8f62ef144..55fa2da6e 100644 --- a/runsc/cmd/chroot.go +++ b/runsc/cmd/chroot.go @@ -176,7 +176,7 @@ func tpuProxyUpdateChroot(chroot string, conf *config.Config) error { if err != nil { return fmt.Errorf("error parsing path %q: %v", sysAccelPath, err) } - if err := mountInChroot(chroot, sysPCIDeviceDir, sysPCIDeviceDir, "bind", unix.MS_BIND); err != nil { + if err := mountInChroot(chroot, sysPCIDeviceDir, sysPCIDeviceDir, "bind", unix.MS_BIND|unix.MS_RDONLY); err != nil { return fmt.Errorf("error mounting %q in chroot: %v", sysAccelPath, err) } }