<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Laurent,<br>
<br>
Thank you for asking me to verify! I created a fresh Debian
Testing VM installation with GNOME desktop and tested immediately
after first login:<br>
<br>
<font face="Courier New, Courier, monospace">$ groups<br>
kristjan cdrom floppy audio dip video plugdev users netdev
scanner bluetooth lpadmin<br>
# Note: render is NOT in the list<br>
<br>
$ getent group render<br>
render:x:991:<br>
# render group exists but is empty<br>
<br>
$ getfacl /dev/dri/renderD128<br>
user::rw-<br>
user:kristjan:rw- <-- ACL automatically set!<br>
group::rw-<br>
<br>
$ loginctl show-session ... | grep Type<br>
Type=wayland</font><br>
<br>
So you're absolutely correct: logind is automatically setting ACLs
for the active user, making group membership unnecessary. The
system works as designed.<br>
<br>
My apologies for the false alarm - the original Vulkan error was
unrelated (GPU driver issue with my AMD RX 9060 XT). The ACL-based
approach works perfectly out-of-the-box.<br>
<br>
Feel free to close this bug as "works as designed".<br>
<br>
Best regards,<br>
Kristjan</p>
<div class="moz-cite-prefix">On 2/11/26 09:46, Laurent Bigonville
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:41f2c23b-42bc-4a16-9575-4d6a675f6f5c@debian.org">Le
28/12/25 à 11:50, Cyril Brulebois a écrit :
<br>
<blockquote type="cite">Hi Kristjan,
<br>
<br>
And thanks for the report.
<br>
<br>
Kristjan <a class="moz-txt-link-rfc2396E" href="mailto:kristjan.schmidt@googlemail.com"><kristjan.schmidt@googlemail.com></a> (2025-12-28):
<br>
<blockquote type="cite">After a fresh Debian Testing
installation (installer build 20250803+deb13u1)
<br>
with GNOME desktop (task-gnome-desktop), the created user was
not added to
<br>
the 'render' group, although the group exists in the system.
<br>
<br>
What led up to the situation?
<br>
* Standard Debian Testing netinstall with GNOME desktop task
selected
<br>
* User created during installation process
<br>
<br>
What was the outcome?
<br>
* User is member of: cdrom floppy audio dip video plugdev
users netdev
<br>
scanner bluetooth lpadmin input
<br>
* The 'render' group exists (GID 992) but is completely empty
<br>
* Vulkan applications fail with errors like:
<br>
"Gdk-WARNING: Vulkan: Could not open device
/dev/dri/renderD128:
<br>
Invalid argument (VK_ERROR_INCOMPATIBLE_DRIVER)"
<br>
</blockquote>
</blockquote>
This is quite weird as with a default installation (using systemd
and logind) a local user should have all the necessary rights and
everything should work out-of-the-box.
<br>
<blockquote type="cite">
<blockquote type="cite">
<br>
What outcome did you expect?
<br>
* Desktop users should be automatically added to the 'render'
group during
<br>
installation, similar to how they are added to the 'video'
group
<br>
* The 'render' group is required for GPU computing and Vulkan
applications
<br>
to access /dev/dri/renderD* devices
<br>
[...]
<br>
</blockquote>
</blockquote>
Did you check that your user is properly opening a logind session
(with loginctl)?
<br>
<blockquote type="cite">Over the past few years, the trend has
been to shrink the number of
<br>
groups set up via the installer, because other components can do
that
<br>
automatically (and not just for the first user).
<br>
<br>
I'm cc-ing Laurent, who contributed such changes.
<br>
</blockquote>
Yes I still think we have to many default groups already
<br>
</blockquote>
</body>
</html>