mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'opencl-nvidia-update' into 'master'

Browse source 
Use nvidia_modprobe named profile inside opencl-nvidia abstraction

Commit 8f9bd5b0 rightfully removed PUx
transition into nvidia-modprobe executable due to security concerns. To
overcome this, commit 327420b1 added
named nvidia_modprobe profile, which allows to use this abstraction
without requiring additional rules to make OpenCL work with NVIDIA
drivers.

Add rule to allow Px transition into nvidia_modprobe profile for
nvidia-modprobe executable.

I propose this for 2.13..master (opencl* are only available in 2.13...). Please check if nvidia_modprobe is already backported.

https://gitlab.com/apparmor/apparmor/merge_requests/219

Acked-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2018-10-05 06:46:43 +00:00
commit 5718aa04ed
1 changed files with 2 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
profiles/apparmor.d/abstractions/opencl-nvidia
View file

@ -8,11 +8,8 @@
# https://github.com/NVIDIA/nvidia-modprobe
# This setuid executable is used to create various device files and load the
# the nvidia kernel module and is therefore not appropriate for a general
# purpose abstraction. Confined applications currently need to add this rule
# in their policy. At some point, a profile may be provided for this command
# such that Px would succeed.
#/usr/bin/nvidia-modprobe Pix,
# the nvidia kernel module.
/usr/bin/nvidia-modprobe Px -> nvidia_modprobe,
# System files