[pkg-apparmor] Bug#921875: apparmor: nvidia_modprobe named profile is missing

Vincas Dargis vindrg at gmail.com
Sat Feb 9 17:49:43 GMT 2019


Package: apparmor
Version: 2.13.2-7
Severity: normal

Dear Maintainer,

opencl-nvidia has this line [0]:

```
/usr/bin/nvidia-modprobe Px -> nvidia_modprobe,
```

It transitions to nvidia_modprobe profile, but that proffile is missing
in apparmor package [1]:

$ dpkg -S nvidia_modprobe
dpkg-query: no path found matching pattern *nvidia_modprobe*


opencl-nvidia abstraction is used by Libreoffice profile, and this produces an
error:

```
type=AVC msg=audit(1549734393.779:810): apparmor="DENIED"
operation="exec" info="profile transition not found" error=-13
profile="libreoffice-soffice" name="/usr/bin/nvidia-modprobe" pid=15848
comm="soffice.bin" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0
```

To reproduce this, one should open Calc, got to Options to enable
OpenCL, and restart Calc. "optirun" is needed on hybrid graphics laptop
to enable NVIDIA and reproduce this.


[0]
https://salsa.debian.org/apparmor-team/apparmor/blob/debian/2.13.2-7/profiles/apparmor.d/abstractions/opencl-nvidia#L12

[1] https://packages.debian.org/search?searchon=contents&keywords=nvidia_modprobe&mode=exactfilename&suite=unstable&arch=any

-- System Information:
Debian Release: buster/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-2-amd64 (SMP w/8 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=lt_LT.UTF-8, LC_CTYPE=lt_LT.UTF-8 (charmap=UTF-8), LANGUAGE=lt (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apparmor depends on:
ii  debconf [debconf-2.0]  1.5.70
ii  libc6                  2.28-6
ii  lsb-base               10.2018112800
ii  python3                3.7.2-1

apparmor recommends no packages.

Versions of packages apparmor suggests:
ii  apparmor-profiles-extra  1.25
ii  apparmor-utils           2.13.2-7

-- debconf information:
  apparmor/homedirs:



More information about the pkg-apparmor-team mailing list