apparmor/profiles/apparmor.d/abstractions/mesa

# vim:syntax=apparmor
# Rules for Mesa implementation of the OpenGL API

  abi <abi/3.0>,

  # System files
  /dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2()

  # Needed to check if the kernel supports the i915 perf interface
  # (src/intel/perf/gen_perf.c, load_oa_metrics())
  @{PROC}/sys/dev/i915/perf_stream_paranoid r,

  # User files
  owner @{HOME}/.cache/ w, # if user clears all caches
  owner @{HOME}/.cache/mesa_shader_cache/ w,
  owner @{HOME}/.cache/mesa_shader_cache/index rw,
  owner @{HOME}/.cache/mesa_shader_cache/??/ w,
  owner @{HOME}/.cache/mesa_shader_cache/??/* rwk,


  # Include additions to the abstraction
  #include if exists <abstractions/mesa.d>
Add mesa abstraction Add mesa abstraction to allow writing to the Mesa-specific cache locations and listing devices. Abstraction is needed for applications utilizing OpenGL API with Mesa implementation available on the system. 2018-06-23 17:07:05 +03:00			`# vim:syntax=apparmor`
			`# Rules for Mesa implementation of the OpenGL API`

policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com> 2020-05-05 00:08:39 -07:00			`abi <abi/3.0>,`

Add mesa abstraction Add mesa abstraction to allow writing to the Mesa-specific cache locations and listing devices. Abstraction is needed for applications utilizing OpenGL API with Mesa implementation available on the system. 2018-06-23 17:07:05 +03:00			`# System files`
			`/dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2()`

abstractions/mesa: allow checking if the kernel supports the i915 perf interface On current Debian sid, applications that use mesa need this access. 2020-03-31 09:14:58 +00:00			`# Needed to check if the kernel supports the i915 perf interface`
			`# (src/intel/perf/gen_perf.c, load_oa_metrics())`
			`@{PROC}/sys/dev/i915/perf_stream_paranoid r,`

Add mesa abstraction Add mesa abstraction to allow writing to the Mesa-specific cache locations and listing devices. Abstraction is needed for applications utilizing OpenGL API with Mesa implementation available on the system. 2018-06-23 17:07:05 +03:00			`# User files`
			`owner @{HOME}/.cache/ w, # if user clears all caches`
			`owner @{HOME}/.cache/mesa_shader_cache/ w,`
			`owner @{HOME}/.cache/mesa_shader_cache/index rw,`
			`owner @{HOME}/.cache/mesa_shader_cache/??/ w,`
mesa abstraction: allow locking .cache/mesa_shader_cache/??/*. At least Totem needs it on current Debian sid. 2018-07-24 07:21:51 +00:00			`owner @{HOME}/.cache/mesa_shader_cache/??/* rwk,`
Add mesa abstraction Add mesa abstraction to allow writing to the Mesa-specific cache locations and listing devices. Abstraction is needed for applications utilizing OpenGL API with Mesa implementation available on the system. 2018-06-23 17:07:05 +03:00
Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com> 2019-01-24 03:03:11 -08:00
			`# Include additions to the abstraction`
			`#include if exists <abstractions/mesa.d>`