CDI spec file gets created with 600 access

[tkatila]

We have written a CDI spec generator tool for Intel GPUs. When using it, I noticed that even though the directory for the CDI specs is created with 755, the files themselves are created with 600. We are using cache's WriteSpec function. This has the downside that docker or podman has to be executed with sudo/root so it can read the CDI specs. As the CDI specs typically reside in root access directories (/etc, /var/run), executing the generator without sudo isn't possible.

For non-root use, I believe the CDI specs should be readable by all.

[elezar]

We use the following logic to ensure that the spec is world-readable: https://github.com/NVIDIA/nvidia-container-toolkit/blob/f959c0daaa30e7079458e550ed867cd4faf4a102/pkg/nvcdi/spec/spec.go#L67-L69

It may be useful to consider using something like renameio though to ensure atomic writes: https://github.com/NVIDIA/k8s-device-plugin/blob/c181c46f5fdeb367f16c5f9ab8be83c3ae60a90e/internal/lm/output.go#L90