fixup! Add a hook to update nvidia params

Signed-off-by: Evan Lezar <[email protected]>

Author: elezar

cmd/nvidia-cdi-hook/update-nvidia-params/mount_linux.go

@@ -24,6 +24,6 @@ import (
 )
 
 func bindMountReadonly(source string, target string) error {
-	return unix.Mount(source, target, "", unix.MS_BIND|unix.MS_RDONLY, "")
+	return unix.Mount(source, target, "", unix.MS_BIND|unix.MS_RDONLY|unix.MS_NOSYMFOLLOW, "")
 
 }

cmd/nvidia-cdi-hook/update-nvidia-params/update-nvidia-params.go

@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/urfave/cli/v2"
@@ -150,7 +151,7 @@ func (m command) updateNvidiaParamsFromReader(r io.Reader, containerRoot string)
 		return fmt.Errorf("failed to set permissions on temporary params file: %w", err)
 	}
 
-	if err := bindMountReadonly(containerParamsFile.Name(), nvidiaDriverParamsPath); err != nil {
+	if err := bindMountReadonly(containerParamsFile.Name(), filepath.Join(containerRoot, nvidiaDriverParamsPath)); err != nil {
 		return fmt.Errorf("failed to create temporary parms file mount: %w", err)
 	}