From 8e50c351e11cd821df18cc383b5fceec1e15580c Mon Sep 17 00:00:00 2001 From: Vincas Dargis Date: Sat, 11 Feb 2023 19:42:58 +0200 Subject: [PATCH] nvidia_modprobe: update for driver families and /sys path Debian have split NVIDIA drivers into current, tesla and legacy: ``` $ apt-file search /etc/nvidia/ | grep -P -o -e "(?<=/etc/nvidia/).[^/]*/" | sort -u current/ current-open/ legacy-340xx/ legacy-390xx/ tesla/ tesla-418/ tesla-450/ tesla-460/ tesla-470/ tesla-510/ ``` These paths are used by nvidia_modprobe -> kmod: ``` type=AVC msg=audit(1676135718.796:2592): apparmor="DENIED" operation="open" profile="nvidia_modprobe//kmod" name="/etc/nvidia/tesla-470/nvidia-blacklists-nouveau.conf" pid=62094 comm="modprobe" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root" type=AVC msg=audit(1676135718.796:2593): apparmor="DENIED" operation="open" profile="nvidia_modprobe//kmod" name="/etc/nvidia/tesla-470/nvidia-options.conf" pid=62094 comm="modprobe" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root" type=AVC msg=audit(1676135718.796:2594): apparmor="DENIED" operation="open" profile="nvidia_modprobe//kmod" name="/etc/nvidia/tesla-470/nvidia-modprobe.conf" pid=62094 comm="modprobe" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root" ``` Also, additional /sys path is accessed: ``` type=AVC msg=audit(1676136251.680:2956): apparmor="DENIED" operation="open" profile="nvidia_modprobe//kmod" name="/sys/module/drm/initstate" pid=63642 comm="modprobe" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root" ``` Update nvidia_modprobe profile to this these denials. --- profiles/apparmor.d/nvidia_modprobe | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/profiles/apparmor.d/nvidia_modprobe b/profiles/apparmor.d/nvidia_modprobe index 2502c49d4..558f48207 100644 --- a/profiles/apparmor.d/nvidia_modprobe +++ b/profiles/apparmor.d/nvidia_modprobe @@ -54,10 +54,10 @@ profile nvidia_modprobe { # System files /etc/modprobe.d/{,*.conf} r, - /etc/nvidia/current/*.conf r, + /etc/nvidia/{current,legacy*,tesla*}/*.conf r, @{sys}/module/ipmi_devintf/initstate r, @{sys}/module/ipmi_msghandler/initstate r, - @{sys}/module/nvidia/initstate r, + @{sys}/module/{drm,nvidia}/initstate r, @{PROC}/cmdline r, }