apparmor/profiles/apparmor.d/abstractions/opencl-intel

# vim:syntax=apparmor

  abi <abi/3.0>,

# OpenCL access requirements for Intel implementation

  include <abstractions/opencl-common>

  # for libcl.so (libOpenCL.so -> beignet/libcl.so calls XOpenDisplay())
  include <abstractions/X>

  # for libOpenCL.so -> beignet/libcl.so -> libpciaccess.so
  include <abstractions/dri-enumerate>

  # System files

  /dev/dri/card[0-9]* rw, # beignet/libcl.so
  @{sys}/devices/pci[0-9]*/**/{class,config,resource,revision} r, # libcl.so -> libdrm_intel.so -> libpciaccess.so (move to dri-enumerate ?)
  /usr/lib/@{multiarch}/beignet/** r,


  # Include additions to the abstraction
  include if exists <abstractions/opencl-intel.d>
Add OpenCL abstractions 2018-05-13 20:14:15 +00:00			`# vim:syntax=apparmor`
policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com> 2020-05-05 00:08:39 -07:00
			`abi <abi/3.0>,`

Add OpenCL abstractions 2018-05-13 20:14:15 +00:00			`# OpenCL access requirements for Intel implementation`

Change `#include` to `include` in abstractions and tunables 2020-06-09 23:28:41 +02:00			`include <abstractions/opencl-common>`
Add OpenCL abstractions 2018-05-13 20:14:15 +00:00
			`# for libcl.so (libOpenCL.so -> beignet/libcl.so calls XOpenDisplay())`
Change `#include` to `include` in abstractions and tunables 2020-06-09 23:28:41 +02:00			`include <abstractions/X>`
Add OpenCL abstractions 2018-05-13 20:14:15 +00:00
			`# for libOpenCL.so -> beignet/libcl.so -> libpciaccess.so`
Change `#include` to `include` in abstractions and tunables 2020-06-09 23:28:41 +02:00			`include <abstractions/dri-enumerate>`
Add OpenCL abstractions 2018-05-13 20:14:15 +00:00
			`# System files`

			`/dev/dri/card[0-9]* rw, # beignet/libcl.so`
Use @{sys} tunable in profiles and abstractions Commit aa065287909f6a3115bfaf02bee85d323e46b706 made @{sys} tunable available by default. Update profiles and abstractions to actually use @{sys} tunable for better confinement in the future (when @{sys} becomes kernel var). Closes LP#1728551 2018-11-08 20:00:45 +02:00			`@{sys}/devices/pci[0-9]/*/{class,config,resource,revision} r, # libcl.so -> libdrm_intel.so -> libpciaccess.so (move to dri-enumerate ?)`
Add OpenCL abstractions 2018-05-13 20:14:15 +00:00			`/usr/lib/@{multiarch}/beignet/** r,`

Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com> 2019-01-24 03:03:11 -08:00
			`# Include additions to the abstraction`
abstractions: remove '#' from 'include if exists' This matches what we use in the profiles for local abstractions. Also adjust the check in the Makefile to expect the variant without '#'. 2020-05-30 19:46:08 +02:00			`include if exists <abstractions/opencl-intel.d>`