This patch modifies the nvidia abstraction to add the livdpau wrapper
config file for nvidia workarounds. It also converts the /proc/
rules to use the @{PROC} tunable. And finally, it converts the
ubuntu-browsers.d/multimedia abstraction to use the nvidia abstraction.
---
profiles/apparmor.d/abstractions/nvidia | 7 +++++--
profiles/apparmor.d/abstractions/ubuntu-browsers.d/multimedia | 6 ++----
2 files changed, 7 insertions(+), 6 deletions(-)
Index: b/profiles/apparmor.d/abstractions/nvidia
===================================================================
--- a/profiles/apparmor.d/abstractions/nvidia
+++ b/profiles/apparmor.d/abstractions/nvidia
@@ -4,9 +4,12 @@
# configuration queries
capability ipc_lock,
+ # libvdpau config file for nvidia workarounds
+ /etc/vdpau_wrapper.cfg r,
+
# device files
/dev/nvidia0 rw,
/dev/nvidiactl rw,
- /proc/interrupts r,
- /proc/sys/vm/max_map_count r,
+ @{PROC}/interrupts r,
+ @{PROC}/sys/vm/max_map_count r,
Index: b/profiles/apparmor.d/abstractions/ubuntu-browsers.d/multimedia
===================================================================
--- a/profiles/apparmor.d/abstractions/ubuntu-browsers.d/multimedia
+++ b/profiles/apparmor.d/abstractions/ubuntu-browsers.d/multimedia
@@ -50,10 +50,8 @@
/opt/google/talkplugin/GoogleTalkPlugin ixr,
owner @{HOME}/.config/google-googletalkplugin/** rw,
- # If we allow the above, nvidia based systems will also need these
- /dev/nvidactl rw,
- /dev/nvidia0 rw,
- @{PROC}/interrupts r,
+ # If we allow the above, nvidia based systems will also need this
+ #include <abstractions/nvidia>
# Virus scanners
/usr/bin/clamscan Cx -> sanitized_helper,
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
