15 lines
1.1 KiB
Python
15 lines
1.1 KiB
Python
import pathlib,json,subprocess,stat,shutil
|
|
root=pathlib.Path('/home/ps/huobao-gpu-selection')
|
|
# The extra provider file contains only node names, URLs and token-file paths.
|
|
(root/'extra-providers.json').chmod(0o644)
|
|
d=json.loads(subprocess.check_output(['docker','inspect','canvas-h3-prompt-normalizer-healthy-20261026'],text=True))[0]
|
|
tokens=pathlib.Path(next(m['Source'] for m in d['Mounts'] if m['Destination']=='/run/h3-workers'))
|
|
files=[p for p in tokens.iterdir() if p.name!='huobao-gpu1.token' and p.is_file()]
|
|
print('Existing token file permissions',[(p.name,oct(stat.S_IMODE(p.stat().st_mode)),p.stat().st_uid,p.stat().st_gid) for p in files])
|
|
assert shutil.which('setfacl'),'A named service-user ACL is required; keep the private token unchanged otherwise'
|
|
target=tokens/'huobao-gpu1.token'
|
|
assert stat.S_IMODE(target.stat().st_mode)&0o007==0,'Token must not be world-readable'
|
|
subprocess.run(['setfacl','-m','u:65534:r--',str(target)],check=True)
|
|
assert stat.S_IMODE(target.stat().st_mode)&0o007==0
|
|
print('Only the existing normalizer service UID 65534 receives read access; token remains inaccessible to other users')
|