# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

  abi <abi/4.0>,

  @{bin}/nvidia-modprobe px -> child-modprobe-nvidia,

  /opt/cuda/targets/@{arch}-linux/lib/*.so mr,
  /opt/cuda/targets/@{arch}-linux/lib/*.so.* mr,

  /usr/share/nvidia/nvidia-application-profiles-* r,

  /etc/nvidia/nvidia-application-profiles-* r,
  /etc/nvidia/nvidia-application-profiles-rc.d/{,*} r,
  /etc/vdpau_wrapper.cfg r,

  owner @{HOME}/.nv/ w,
  owner @{HOME}/.nv/ComputeCache/ w,
  owner @{HOME}/.nv/ComputeCache/** rw,
  owner @{HOME}/.nv/ComputeCache/index rwk,
  owner @{HOME}/.nv/nvidia-application-profiles-* r,

        @{user_cache_dirs}/nvidia/GLCache/@{hex32}/ rw,
  owner @{user_cache_dirs}/nvidia/ w,
  owner @{user_cache_dirs}/nvidia/GLCache/ rw,
  owner @{user_cache_dirs}/nvidia/GLCache/** rwk,

  @{sys}/devices/@{pci}/numa_node r,
  @{sys}/devices/system/memory/block_size_bytes r,
  @{sys}/module/nvidia_drm/version r,
  @{sys}/module/nvidia/version r,

  @{PROC}/driver/nvidia/capabilities/mig/monitor r,
  @{PROC}/driver/nvidia/gpus/@{pci_id}/information r,
  @{PROC}/driver/nvidia/params r,
  @{PROC}/modules r,
  @{PROC}/sys/vm/max_map_count r,
  @{PROC}/sys/vm/mmap_min_addr r,

        @{PROC}/@{pid}/cmdline r,
        @{PROC}/@{pid}/comm r,
  owner @{PROC}/@{pid}/task/@{tid}/comm r,

  /dev/char/195:@{u8} w,  # Nvidia graphics devices

  # Nvidia proprietary modset driver
  /dev/nvidia-modeset rw,

  # Nvidia graphics devices
  /dev/nvidia@{int} rw,

  # Nvidia's Unified Memory driver
  /dev/nvidia-uvm rw,
  /dev/nvidia-uvm-tools rw,

  # Nvidia's control device
  /dev/nvidiactl rw,

  deny owner @{HOME}/.nv/.local/share/gvfs-metadata/* r,

  include if exists <abstractions/nvidia-strict.d>

# vim:syntax=apparmor
