diff --git a/profiles/apparmor.d/nvidia_modprobe b/profiles/apparmor.d/nvidia_modprobe new file mode 100644 index 000000000..907820fba --- /dev/null +++ b/profiles/apparmor.d/nvidia_modprobe @@ -0,0 +1,63 @@ +# vim:syntax=apparmor + +#include + +profile nvidia_modprobe { + #include + + # Capabilities + + capability chown, + capability mknod, + capability setuid, + capability sys_admin, + + # Main executable + + /usr/bin/nvidia-modprobe mr, + + # Other executables + + /usr/bin/kmod Cx -> kmod, + + # System files + + /dev/nvidia-uvm w, + /dev/nvidia-uvm-tools w, + /sys/bus/pci/devices/ r, + /sys/devices/pci[0-9]*/**/config r, + @{PROC}/devices r, + @{PROC}/modules r, + @{PROC}/sys/kernel/modprobe r, + + # Child profiles + + profile kmod { + #include + + # Capabilities + + capability sys_module, + + # Main executable + + /usr/bin/kmod mrix, + + # Other executables + + /{,usr/}bin/{,ba,da}sh ix, + + # System files + + /etc/modprobe.d/{,*.conf} r, + /etc/nvidia/current/*.conf r, + /sys/module/ipmi_devintf/initstate r, + /sys/module/ipmi_msghandler/initstate r, + /sys/module/nvidia/initstate r, + @{PROC}/cmdline r, + } + + # Site-specific additions and overrides. See local/README for details. + #include +} +