From bbc6fb1c36029e122ea7b664e439e98ec527aee7 Mon Sep 17 00:00:00 2001 From: Michael Chus Date: Sat, 12 Sep 2026 11:53:52 +0300 Subject: [PATCH] fix(nvidia): own /var/log/nvidia-dcgm so dcgmi diag deployment check passes nv-hostengine drops privileges to --service-account nvidia-dcgm for all file I/O and writes diagnostics to DCGM_HOME_DIR (/var/log/nvidia-dcgm, per the packaged unit's Environment=). The package postinst doesn't reliably create/own this directory inside a live-build chroot, so dcgmi diag's software deployment check fails with DCGM_FR_FILE_CREATE_PERMISSIONS at boot even though every GPU passes the actual hardware tests. Co-Authored-By: Claude Sonnet 5 --- .../config/hooks/normal/9000-bee-setup.hook.chroot | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot b/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot index 7e2ba00..1ddaba1 100755 --- a/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot +++ b/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot @@ -46,6 +46,17 @@ if [ "$GPU_VENDOR" = "nvidia" ]; then systemctl enable nvidia-dcgm.service 2>/dev/null || true systemctl enable nvidia-fabricmanager.service 2>/dev/null || true systemctl enable bee-nvidia.service + + # nvidia-dcgm.service runs `nv-hostengine --service-account nvidia-dcgm`, + # which drops privileges to that account for all file I/O and writes + # diagnostics to DCGM_HOME_DIR (/var/log/nvidia-dcgm, per the packaged + # unit's Environment=). The package postinst doesn't reliably create/own + # this directory inside a live-build chroot, so `dcgmi diag`'s deployment + # check fails with DCGM_FR_FILE_CREATE_PERMISSIONS at boot. Own it here + # to match nv-hostengine's actual runtime identity. + if id nvidia-dcgm >/dev/null 2>&1; then + install -d -o nvidia-dcgm -g nvidia-dcgm -m 0755 /var/log/nvidia-dcgm + fi elif [ "$GPU_VENDOR" = "amd" ]; then # ROCm symlinks (packages install to /opt/rocm-*/bin/) for tool in rocm-smi rocm-bandwidth-test rvs; do