From 39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Fri, 20 Mar 2026 19:16:32 +0100 Subject: feat: first fully successful run e2e on straper --- .../public/apparmor/apparmor.d/abstractions/nvidia | 40 ++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 straper/db/public/apparmor/apparmor.d/abstractions/nvidia (limited to 'straper/db/public/apparmor/apparmor.d/abstractions/nvidia') diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nvidia b/straper/db/public/apparmor/apparmor.d/abstractions/nvidia new file mode 100644 index 0000000..fb1ffaf --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/nvidia @@ -0,0 +1,40 @@ +# vim:syntax=apparmor +# nvidia access requirements + + abi , + + # configuration queries + capability ipc_lock, + + /etc/nvidia/nvidia-application-profiles* r, + /usr/share/nvidia/nvidia-application-profiles* r, + + # libvdpau config file for nvidia workarounds + /etc/vdpau_wrapper.cfg r, + + # device files + /dev/nvidiactl rw, + /dev/nvidia-modeset rw, + /dev/nvidia[0-9]* rw, + + @{PROC}/interrupts r, + @{PROC}/sys/vm/max_map_count r, + @{PROC}/driver/nvidia/params r, + @{PROC}/modules r, + + @{sys}/devices/system/memory/block_size_bytes r, + + owner @{HOME}/.cache/nvidia/ w, + owner @{HOME}/.cache/nvidia/GLCache/ rw, + owner @{HOME}/.cache/nvidia/GLCache/** rwk, + owner @{HOME}/.nv/ w, + owner @{HOME}/.nv/GLCache/ rw, + owner @{HOME}/.nv/GLCache/** rwk, + owner @{HOME}/.nv/nvidia-application-profiles* r, + owner @{PROC}/@{pid}/comm r, # somehwere in libnvidia-glcore.so + + unix (send, receive) type=dgram peer=(addr="@nvidia[0-9a-f]*"), + unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"), + + # Include additions to the abstraction + include if exists -- cgit v1.3