1 files changed, 67 insertions, 0 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/nvidia_modprobe b/straper/db/public/apparmor/apparmor.d/nvidia_modprobe
new file mode 100644
index 0000000..c9642fd
--- /dev/null
+++ b/straper/db/public/apparmor/apparmor.d/nvidia_modprobe
@@ -0,0 +1,67 @@
+# vim:syntax=apparmor
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+profile nvidia_modprobe {
+  include <abstractions/base>
+
+  # Capabilities
+
+  capability chown,
+  capability mknod,
+  capability setuid,
+  capability sys_admin,
+
+  # Main executable
+
+  /usr/bin/nvidia-modprobe mr,
+
+  # Other executables
+
+  /usr/bin/kmod Cx -> kmod,
+
+  # System files
+
+  /dev/nvidia-modeset w,
+  /dev/nvidia-uvm w,
+  /dev/nvidia-uvm-tools w,
+  @{sys}/bus/pci/devices/ r,
+  @{sys}/devices/pci[0-9]*/**/config r,
+  @{PROC}/devices r,
+  @{PROC}/driver/nvidia/params r,
+  @{PROC}/modules r,
+  @{PROC}/sys/kernel/modprobe r,
+
+  # Child profiles
+
+  profile kmod {
+    include <abstractions/base>
+
+    # Capabilities
+
+    capability sys_module,
+
+    # Main executable
+
+    /usr/bin/kmod mrix,
+
+    # Other executables
+
+    /{,usr/}bin/{,ba,da}sh ix,
+
+    # System files
+
+    /etc/modprobe.d/{,*.conf} r,
+    /etc/nvidia/{current,legacy*,tesla*}/*.conf r,
+    @{sys}/module/ipmi_devintf/initstate r,
+    @{sys}/module/ipmi_msghandler/initstate r,
+    @{sys}/module/{drm,nvidia}/initstate r,
+    @{PROC}/cmdline r,
+  }
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/nvidia_modprobe>
+}
+