From 30c17b253ab1fed064ff1f84af15025843e765b3 Mon Sep 17 00:00:00 2001
From: Christopher Desiniotis <cdesiniotis@nvidia.com>
Date: Thu, 27 Aug 2026 17:03:06 -0700
Subject: [PATCH] fix: update all CDI hooks to fail for invalid container root
 paths

Signed-off-by: Christopher Desiniotis <cdesiniotis@nvidia.com>
---
 cmd/nvidia-cdi-hook/chmod/chmod.go                           | 4 ++--
 cmd/nvidia-cdi-hook/create-symlinks/create-symlinks.go       | 3 +++
 cmd/nvidia-cdi-hook/cudacompat/cudacompat.go                 | 3 +++
 .../disable-device-node-modification.go                      | 3 +++
 .../update-application-profile/update-application-profile.go | 3 +++
 cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go         | 5 ++++-
 6 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/cmd/nvidia-cdi-hook/chmod/chmod.go b/cmd/nvidia-cdi-hook/chmod/chmod.go
index 9b06fb129..97c1a8f5e 100644
--- a/cmd/nvidia-cdi-hook/chmod/chmod.go
+++ b/cmd/nvidia-cdi-hook/chmod/chmod.go
@@ -117,8 +117,8 @@ func (m command) run(_ *cli.Command, cfg *config) error {
 	if err != nil {
 		return fmt.Errorf("failed to determined container root: %v", err)
 	}
-	if containerRoot == "" {
-		return fmt.Errorf("empty container root detected")
+	if containerRoot == "" || containerRoot == "/" {
+		return fmt.Errorf("invalid container root: %q", containerRoot)
 	}
 
 	paths := m.getPaths(containerRoot, cfg.paths, cfg.mode)
diff --git a/cmd/nvidia-cdi-hook/create-symlinks/create-symlinks.go b/cmd/nvidia-cdi-hook/create-symlinks/create-symlinks.go
index 31553b3f2..9374a65a2 100644
--- a/cmd/nvidia-cdi-hook/create-symlinks/create-symlinks.go
+++ b/cmd/nvidia-cdi-hook/create-symlinks/create-symlinks.go
@@ -87,6 +87,9 @@ func (m command) run(_ *cli.Command, cfg *config) error {
 	if err != nil {
 		return fmt.Errorf("failed to determined container root: %v", err)
 	}
+	if containerRoot == "" || containerRoot == "/" {
+		return fmt.Errorf("invalid container root: %q", containerRoot)
+	}
 
 	created := make(map[string]bool)
 	for _, l := range cfg.links {
diff --git a/cmd/nvidia-cdi-hook/cudacompat/cudacompat.go b/cmd/nvidia-cdi-hook/cudacompat/cudacompat.go
index 5b1e674d0..e947a07a8 100644
--- a/cmd/nvidia-cdi-hook/cudacompat/cudacompat.go
+++ b/cmd/nvidia-cdi-hook/cudacompat/cudacompat.go
@@ -125,6 +125,9 @@ func (m command) run(_ *cli.Command, o *options) error {
 	if err != nil {
 		return fmt.Errorf("failed to determined container root: %w", err)
 	}
+	if containerRootDir == "" || containerRootDir == "/" {
+		return fmt.Errorf("invalid container root: %q", containerRootDir)
+	}
 
 	containerRoot, err := newRoot(containerRootDir)
 	if err != nil {
diff --git a/cmd/nvidia-cdi-hook/disable-device-node-modification/disable-device-node-modification.go b/cmd/nvidia-cdi-hook/disable-device-node-modification/disable-device-node-modification.go
index 2a4ce5369..d9f89fc80 100644
--- a/cmd/nvidia-cdi-hook/disable-device-node-modification/disable-device-node-modification.go
+++ b/cmd/nvidia-cdi-hook/disable-device-node-modification/disable-device-node-modification.go
@@ -89,6 +89,9 @@ func run(_ context.Context, _ *cli.Command, cfg *options) error {
 	if err != nil {
 		return fmt.Errorf("failed to determined container root: %w", err)
 	}
+	if containerRootDirPath == "" || containerRootDirPath == "/" {
+		return fmt.Errorf("invalid container root: %q", containerRootDirPath)
+	}
 
 	containerRoot, err := os.OpenRoot(containerRootDirPath)
 	if err != nil {
diff --git a/cmd/nvidia-cdi-hook/update-application-profile/update-application-profile.go b/cmd/nvidia-cdi-hook/update-application-profile/update-application-profile.go
index 2c03c82ae..01a787743 100644
--- a/cmd/nvidia-cdi-hook/update-application-profile/update-application-profile.go
+++ b/cmd/nvidia-cdi-hook/update-application-profile/update-application-profile.go
@@ -95,6 +95,9 @@ func run(_ context.Context, _ *cli.Command, cfg *options, logger logger.Interfac
 	if err != nil {
 		return fmt.Errorf("failed to determine container root: %w", err)
 	}
+	if containerRootDirPath == "" || containerRootDirPath == "/" {
+		return fmt.Errorf("invalid container root: %q", containerRootDirPath)
+	}
 
 	containerRoot, err := os.OpenRoot(containerRootDirPath)
 	if err != nil {
diff --git a/cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go b/cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go
index 7bf5ad5f8..9a1ec16a6 100644
--- a/cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go
+++ b/cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go
@@ -111,9 +111,12 @@ func (m command) run(_ *cli.Command, cfg *options) error {
 	}
 
 	containerRootDir, err := s.GetContainerRoot()
-	if err != nil || containerRootDir == "" || containerRootDir == "/" {
+	if err != nil {
 		return fmt.Errorf("failed to determined container root: %v", err)
 	}
+	if containerRootDir == "" || containerRootDir == "/" {
+		return fmt.Errorf("invalid container root: %q", containerRootDir)
+	}
 
 	runner, err := ldconfig.NewRunner(
 		reexecUpdateLdCacheCommandName,