feat: allow /sbin/ldconfig in extensions

This is specifically for the glibc extension to support nvidia container toolkit. Signed-off-by: Jean-Francois Roy <[email protected]> Signed-off-by: Noel Georgi <[email protected]>
siderolabs · Sep 20, 2024 · 6484581 · 6484581
1 parent 9fa08e8
commit 6484581
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/pkg/machinery/extensions/extensions.go b/pkg/machinery/extensions/extensions.go
@@ -12,7 +12,10 @@ var AllowedPaths = []string{
 	"/etc/cri/conf.d",
 	"/lib/firmware",
 	"/lib/modules",
+	// The glibc loader is required by glibc dynamic binaries.
 	"/lib64/ld-linux-x86-64.so.2",
+	// /sbin/ldconfig is required by the nvidia container toolkit.
+	"/sbin/ldconfig",
 	"/usr/etc/udev/rules.d",
 	"/usr/local",
 	// glvnd, egl and vulkan are needed for OpenGL/Vulkan.