Summary
allowlistedEtcFiles() in the pytorch_inference Sandbox2 filesystem policy may need a distro-specific TLS CA bundle path. The in-code NOTE currently references /etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu) while ml-cpp CI uses a CentOS7/RHEL-based image whose equivalent is /etc/pki/tls/certs/ca-bundle.crt.
Context
PR #3185 adds a minimized /etc allowlist for pytorch_inference Sandbox2 policy. The CA bundle path has not been verified against every supported production distro layout.
Ask
- Confirm which trust-bundle path(s) pytorch_inference/libtorch actually open at runtime on supported Linux distros.
- Add the correct path(s) to
allowlistedEtcFiles() (or document why none is needed).
- Align CI/probe coverage with the chosen path.
Tracked from review thread on #3185 (edsavage).
Summary
allowlistedEtcFiles()in the pytorch_inference Sandbox2 filesystem policy may need a distro-specific TLS CA bundle path. The in-code NOTE currently references/etc/ssl/certs/ca-certificates.crt(Debian/Ubuntu) while ml-cpp CI uses a CentOS7/RHEL-based image whose equivalent is/etc/pki/tls/certs/ca-bundle.crt.Context
PR #3185 adds a minimized
/etcallowlist for pytorch_inference Sandbox2 policy. The CA bundle path has not been verified against every supported production distro layout.Ask
allowlistedEtcFiles()(or document why none is needed).Tracked from review thread on #3185 (edsavage).