Draft: LACT profile - #1088
Conversation
|
Do you mean https://github.com/ilya-zlobintsev/LACT ? If so, it does not run as root, it uses a lactd daemon to collect data. Therefore, a profile for lactd would be nice to have too. Edit: it is not |
| profile lact @{exec_path} { | ||
| include <abstractions/base> | ||
| include <abstractions/graphics> | ||
| include <abstractions/gtk-strict> |
There was a problem hiding this comment.
include <abstractions/gtk-strict>
Use include <abstractions/desktop> instead, it includes a lot of rules you added in this profiles.
| include <abstractions/icons> | ||
| include <abstractions/fontconfig-cache> | ||
| include <abstractions/fonts-strict> |
|
|
||
| /etc/lact/ r, | ||
| /etc/lact/config.yaml rw, | ||
| /etc/group r, |
| /usr/share/libdrm/* r, | ||
| /usr/share/hwdata/pci.ids r, | ||
| /usr/share/xkeyboard-config-2/{,**} r, | ||
| /usr/share/glib-2.0/schemas/gschemas.compiled r, |
| owner @{user_config_dirs}/dconf/user r, | ||
|
|
||
| owner @{run}/user/@{uid}/dconf/user rw, |
There was a problem hiding this comment.
Use abstractions/dconf-write instead
| /usr/share/xkeyboard-config-2/{,**} r, | ||
| /usr/share/glib-2.0/schemas/gschemas.compiled r, | ||
|
|
||
| owner @{user_cache_dirs}/gtk-4.0/** rwk, |
| #@{bin}/vulkaninfo rPx -> vulkaninfo, | ||
| @{bin}/vulkaninfo rPux, | ||
| @{bin}/uname rPx, | ||
| @{bin}/clinfo cx -> clinfo, |
There was a problem hiding this comment.
What is this thing? it is not part of the lact
There was a problem hiding this comment.
It's part of lact gui , package also depends on these
It should be for retrieving graphics api data
| @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/properties r, | ||
| @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/caches/ r, | ||
| @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/caches/@{int}/properties r, |
There was a problem hiding this comment.
Already included in abstraction/graphics-full
| @{sys}/devices/@{pci}/hwmon/hwmon@{int}/pwm@{int}_enable rw, | ||
| @{sys}/devices/@{pci}/hwmon/hwmon@{int}/power@{int}_cap rw, | ||
| @{sys}/devices/@{pci}/hwmon/hwmon@{int}/pwm@{int} rw, |
There was a problem hiding this comment.
Use one the the specialized abstraction instead: https://apparmor.pujol.io/abstractions/sys/
| @{sys}/class/drm/ r, | ||
| @{sys}/devices/@{pci}/drm/ r, | ||
| @{sys}/devices/@{pci}/uevent r, | ||
| @{sys}/devices/@{pci}/hwmon/{,**} r, |
There was a problem hiding this comment.
For all hwmon use one of the hwmon abs: https://apparmor.pujol.io/abstractions/generic/#hwmon
|
|
||
| @{sys}/bus/pci/devices/ r, |
There was a problem hiding this comment.
Most of the rules in @{sys}, should be covered by the abstraction/graphics-full abstraction. Please only keep the ones not in the abs.
| @{PROC}/uptime r, | ||
| @{PROC}/cmdline r, | ||
| @{PROC}/sys/kernel/random/boot_id r, | ||
| @{tmp}/VP_VULKANINFO*.json rw, |
There was a problem hiding this comment.
It should be:
/tmp/VP_VULKANINFO*.json rw,
or:
owner @{tmp}/VP_VULKANINFO*.json rw,
Can the * be precised (int, rand6...)
Also move the line before owner @{run}/user...
There was a problem hiding this comment.
it can't be precised as the filename follows with the GPU name before the extension
| capability chown, | ||
|
|
||
| network netlink raw, | ||
|
|
There was a problem hiding this comment.
You need to add @{exec_path} mr, here too
| include <abstractions/graphics> | ||
| include <abstractions/nameservice-strict> | ||
|
|
||
| #silencer deny capability sys_admin |
There was a problem hiding this comment.
I'm not sure why does it need these caps, I don't think they're actually needed for this profile
|
mkinitcpio should probably transition to the actual profile as it probably adds the needed boot param for amdgpus to unlock overclocking, still investigating, in that case we should add support for the rest of distros |
2 participants
LACT is a popular GUI for configuring and monitoring GPUs
Since it combines root access with a GUI, it could introduce some risks
Missing a lot of rules, especially with Nvidia/Intel and there's probably some duplicates for /sys rules
I'm sorry this is probably not well ordered