diff --git a/apparmor.d/profiles-m-r/nvidia-smi b/apparmor.d/profiles-m-r/nvidia-smi new file mode 100644 index 00000000..571ab331 --- /dev/null +++ b/apparmor.d/profiles-m-r/nvidia-smi @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/nvidia-smi +profile nvidia-smi @{exec_path} { + include + include + include + + @{exec_path} mr, + + @{sys}/devices/system/node/ r, + @{sys}/devices/system/node/node@{int}/cpumap r, + + @{PROC}/devices r, + @{PROC}/driver/nvidia/capabilities/mig/config r, + @{PROC}/driver/nvidia/capabilities/mig/monitor r, + owner @{PROC}/@{pid}/cmdline r, + + /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 + /dev/nvidia-caps/ rw, + /dev/nvidia-caps/nvidia-cap@{int} r, + /dev/nvidia-uvm rw, + /dev/nvidia-uvm-tools r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 737531b4..57862b8c 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -255,6 +255,7 @@ nmap complain nmcli complain nvidia-detector complain nvidia-persistenced complain +nvidia-smi complain okular complain ollama attach_disconnected,complain os-prober attach_disconnected,complain