Bug#818763: nvidia-kernel-dkms: fail to load nvidia-uvm (again)

[Andreas Beckmann]

[Please keep the bug Cc:ed]

On 2016-03-21 22:09, Michael Below wrote:
> Hi,
> 
> Am Mo 21 Mär 2016 00:12:04 CET
> schrieb Andreas Beckmann <anbe at debian.org>:
>  
>>> I just did a reboot, started darktable   
>>
>> you start darktable manually?
> 
> Yes, for testing purposes I start darktable from a terminal window
> using "darktable -d opencl" for opencl debugging output. Otherwise you
> just notice that the image processing is _slow_.
> 
>> Which libopencl1 library are you using?
>> (Note to myself: collect this info in bug-control, and the installed
>> icds, too, and /etc/OpenCL/vendors in bug-script)
> 
> I was using ocl-icd-opencl1 2.2.9-1. I noticed that I have both an
> amd64 and an i386 version of the library installed, and I don't
> think I am using any i386 opencl programs -- should I remove that one?
> 
>> Please install the ocd-icd-libopencl1 and clinfo packages from
>> stretch.
> 
> Done, I already had those installed.
> 
>> and now try clinfo (on the nvidia platform only) to see whether the
>> nvidia-uvm module is loaded automatically
> 
> First I tried it without setting the variable:
> 
> $ clinfo
> modprobe: ERROR: could not insert 'nvidia_current_uvm': Operation not
> permitted modprobe: ERROR: ../libkmod/libkmod-module.c:977 command_do()
> Error running install command for nvidia_uvm modprobe: ERROR: could not
> insert 'nvidia_uvm': Operation not permitted Number of
> platforms                               0
> 
> Then I tried it with OCL_ICD_VENDORS set, same result.
> 
> Any idea what to check next? Maybe the nvidia-icd-libopencl1?

No, it's not a problem with libOpenCL.so, but some permission problem 
with loading the module.

So let's try what should happen within clinfo manually:

(as root)
# modprobe -r nvidia-uvm

(as user)
$ modprobe -v nvidia-uvm

I expect this to fail similarily to the following error:
=====
install modprobe nvidia ; modprobe -i nvidia-current-uvm $CMDLINE_OPTS 
insmod /lib/modules/4.3.0-1-amd64/nvidia/nvidia-current.ko 
modprobe: ERROR: could not insert 'nvidia_current_uvm': Operation not permitted
modprobe: ERROR: ../libkmod/libkmod-module.c:977 command_do() Error running install command for nvidia_uvm
modprobe: ERROR: could not insert 'nvidia_uvm': Operation not permitted
=====

But the libnvidia-opencl.so.1 library does not call modprobe directly,
it uses the nvidia-modprobe setuid root wrapper instead:

(as user)
$ nvidia-modprobe -u
$ dmesg | tail
$ ls -la /usr/bin/nvidia-modprobe

Does that work?
If it doesn't, do you use anything for extra hardening of the system?
(selinux, apparmor, ...?)

Andreas