** Summary changed:
- SDK applications require too many accesses on desktop with nvidia
+ SDK applications require /tmp access with nvidia (should honor TMPDIR)
** Description changed:
Nvidia desktop users need the following AppArmor permissions to avoid denials:
- owner /tmp/gl* mrw,
+ owner /tmp/gl* mrw,
But this rule breaks application confinement such that apps are able to
tamper with each other. Interestingly, apps still run without the rule,
so we can explicitly deny it for now.
The use of /tmp is apparently hardcoded and does not honor TMPDIR
(application confinement will setup TMPDIR to a private area for the app).
strace confirms this:
24603 mkdir("/tmp", 0777) = -1 EEXIST (File exists)
24603 open("/tmp/glBRPYmm", O_RDWR|O_CREAT|O_EXCL, 0600) = -1 EACCES
(Permission denied)
- While the use of O_EXCL is safe however, we don't allow access to /tmp
- for confined apps and libraries/applications should always honor TMPDIR.
+ While the use of O_EXCL is safe, we don't allow access to /tmp for
+ confined apps and libraries/applications should always honor TMPDIR.
--
You received this bug notification because you are a member of Ubuntu-X,
which is subscribed to nvidia-graphics-drivers-tegra in Ubuntu.
https://bugs.launchpad.net/bugs/1212425
Title:
SDK applications require /tmp access with nvidia (should honor TMPDIR)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor-easyprof-ubuntu/+bug/1212425/+subscriptions
_______________________________________________
Mailing list: https://launchpad.net/~ubuntu-x-swat
Post to : ubuntu-x-swat@lists.launchpad.net
Unsubscribe : https://launchpad.net/~ubuntu-x-swat
More help : https://help.launchpad.net/ListHelp
