From 53798e90d557effb5995f9cda5e8b84a694f219f Mon Sep 17 00:00:00 2001 From: Vincas Dargis Date: Thu, 21 May 2020 20:55:00 +0300 Subject: [PATCH] vulkan: fix device and driver enumeration vkcube test application produces these DENIED messages on current Debian Sid: ``` type=AVC msg=audit(1589815066.509:868): apparmor="DENIED" operation="open" profile="/usr/bin/vkcube" name="/sys/devices/pci0000:00/0000:00:02.0/drm/card0/gt_min_freq_mhz" pid=32553 comm="vkcube" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` ``` type=AVC msg=audit(1590082079.377:1155): apparmor="DENIED" operation="open" profile="/usr/bin/vkcube" name="/sys/devices/pci0000:00/0000:00:02.0/drm/card0/gt_max_freq_mhz" pid=51348 comm="vkcube" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` ``` type=AVC msg=audit(1590082107.057:1249): apparmor="DENIED" operation="open" profile="/usr/bin/vkcube" name="/sys/devices/pci0000:00/0000:00:02.0/drm/card0/metrics/" pid=51459 comm="vkcube" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` ``` type=AVC msg=audit(1590082519.937:1408): apparmor="DENIED" operation="open" profile="/usr/bin/vkcube" name="/sys/devices/pci0000:00/0000:00:02.0/drm/card0/metrics/403d8832-1a27-4aa6-a64e-f5389ce7b212/id" pid=51960 comm="vkcube" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` ``` type=AVC msg=audit(1590082842.193:1829): apparmor="DENIED" operation="open" profile="/usr/bin/vkcube" name="/etc/glvnd/egl_vendor.d/" pid=53000 comm="vkcube" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` ``` type=AVC msg=audit(1590082842.193:1830): apparmor="DENIED" operation="open" profile="/usr/bin/vkcube" name="/usr/share/glvnd/egl_vendor.d/" pid=53000 comm="vkcube" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` Add appropriate rules to fix these enumerations. (cherry picked from commit 21bbfc0652537b19d523a47fceb4c45999af7d27) Signed-off-by: John Johansen --- profiles/apparmor.d/abstractions/vulkan | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/profiles/apparmor.d/abstractions/vulkan b/profiles/apparmor.d/abstractions/vulkan index 7f0d8cb98..04c8ec262 100644 --- a/profiles/apparmor.d/abstractions/vulkan +++ b/profiles/apparmor.d/abstractions/vulkan @@ -3,10 +3,15 @@ # System files /dev/dri/ r, # libvulkan_radeon.so, libvulkan_intel.so (Mesa) + /etc/glvnd/egl_vendor.d/{*,.json} r, /etc/vulkan/icd.d/{,*.json} r, /etc/vulkan/{explicit,implicit}_layer.d/{,*.json} r, # for drmGetMinorNameForFD() from libvulkan_intel.so (Mesa) @{sys}/devices/pci[0-9]*/*/drm/ r, + @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/gt_{max,min}_freq_mhz r, # anv_enumerate_physical_devices() from libvulkan_intel.so + @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/metrics/ r, # anv_enumerate_physical_devices() from libvulkan_intel.so + @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/metrics/????????-????-????-????-????????????/id r, # anv_enumerate_physical_devices() from libvulkan_intel.so + /usr/share/glvnd/egl_vendor.d/{,*.json} r, /usr/share/vulkan/icd.d/{,*.json} r, /usr/share/vulkan/{explicit,implicit}_layer.d/{,*.json} r,