gitee.com/mysnapcore/mysnapd@v0.1.0/interfaces/builtin/opengl.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016-2017 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin 21 22 const openglSummary = `allows access to OpenGL stack` 23 24 const openglBaseDeclarationSlots = ` 25 opengl: 26 allow-installation: 27 slot-snap-type: 28 - core 29 ` 30 31 const openglConnectedPlugAppArmor = ` 32 # Description: Can access opengl. 33 34 # specific gl libs 35 /var/lib/snapd/lib/gl{,32}/ r, 36 /var/lib/snapd/lib/gl{,32}/** rm, 37 38 # Bi-arch distribution nvidia support 39 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcuda*.so{,.*} rm, 40 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvidia*.so{,.*} rm, 41 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvoptix*.so{,.*} rm, 42 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}tls/libnvidia*.so{,.*} rm, 43 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvcuvid.so{,.*} rm, 44 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}lib{GL,GLESv1_CM,GLESv2,EGL}*nvidia.so{,.*} rm, 45 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libGLdispatch.so{,.*} rm, 46 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}vdpau/libvdpau_nvidia.so{,.*} rm, 47 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnv{rm,dc,imp,os}*.so{,.*} rm, 48 # CUDA libs 49 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnpp{c,ig,ial,icc,idei,ist,if,im,itc}*.so{,.*} rm, 50 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcublas{,Lt}*.so{,.*} rm, 51 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcufft.so{,.*} rm, 52 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcusolver.so{,.*} rm, 53 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcuparse.so{,.*} rm, 54 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcurand.so{,.*} rm, 55 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcudnn{,_adv_infer,_adv_train,_cnn_infer,_cnn_train,_ops_infer,_ops_train}*.so{,.*} rm, 56 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvrtc{,-builtins}*.so{,.*} rm, 57 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvToolsExt.so{,.*} rm, 58 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}nvidia/wine/*.dll rm, 59 60 # Support reading the Vulkan ICD files 61 /var/lib/snapd/lib/vulkan/ r, 62 /var/lib/snapd/lib/vulkan/** r, 63 /var/lib/snapd/hostfs/usr/share/vulkan/icd.d/*nvidia*.json r, 64 65 # Support reading the GLVND EGL vendor files 66 /var/lib/snapd/lib/glvnd/ r, 67 /var/lib/snapd/lib/glvnd/** r, 68 /var/lib/snapd/hostfs/usr/share/glvnd/egl_vendor.d/ r, 69 /var/lib/snapd/hostfs/usr/share/glvnd/egl_vendor.d/*nvidia*.json r, 70 71 # Support Nvidia EGL external platform 72 /var/lib/snapd/hostfs/usr/share/egl/egl_external_platform.d/ r, 73 /var/lib/snapd/hostfs/usr/share/egl/egl_external_platform.d/*nvidia*.json r, 74 75 # Main bi-arch GL libraries 76 /var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}{,nvidia*/}lib{OpenGL,GL,GLU,GLESv1_CM,GLESv2,EGL,GLX}.so{,.*} rm, 77 78 # Allow access to all cards since a) this is common on hybrid systems, b) ARM 79 # devices commonly have two devices (such as on the Raspberry Pi 4, one for KMS 80 # and another that does not) and c) there is nothing saying that /dev/dri/card0 81 # is the default card or the application is currently using. 82 /dev/dri/ r, 83 /dev/dri/card[0-9]* rw, 84 85 # nvidia 86 /etc/vdpau_wrapper.cfg r, 87 @{PROC}/driver/nvidia/params r, 88 @{PROC}/modules r, 89 /dev/nvidia* rw, 90 unix (send, receive) type=dgram peer=(addr="@nvidia[0-9a-f]*"), 91 92 # VideoCore/EGL (shared device with VideoCore camera) 93 /dev/vchiq rw, 94 # VideoCore Video decoding (required for accelerated MMAL video playback) 95 /dev/vcsm-cma rw, 96 97 # va-api 98 /dev/dri/renderD[0-9]* rw, 99 100 # intel 101 @{PROC}/sys/dev/i915/perf_stream_paranoid r, 102 103 # cuda 104 @{PROC}/sys/vm/mmap_min_addr r, 105 @{PROC}/devices r, 106 /sys/devices/system/memory/block_size_bytes r, 107 /sys/module/tegra_fuse/parameters/tegra_* r, 108 unix (bind,listen) type=seqpacket addr="@cuda-uvmfd-[0-9a-f]*", 109 /{dev,run}/shm/cuda.* rw, 110 /dev/nvhost-* rw, 111 /dev/nvmap rw, 112 113 # Tegra display driver 114 /dev/tegra_dc_ctrl rw, 115 /dev/tegra_dc_[0-9]* rw, 116 117 # Xilinx zocl DRM driver 118 # https://github.com/Xilinx/XRT/tree/master/src/runtime_src/core/edge/drm 119 /sys/devices/platform/amba{,_pl@[0-9]*}/amba{,_pl@[0-9]*}:zyxclmm_drm/* r, 120 121 # Imagination PowerVR driver 122 /dev/pvr_sync rw, 123 124 # ARM Mali driver 125 /dev/mali[0-9]* rw, 126 /dev/dma_buf_te rw, 127 128 # NXP i.MX driver 129 # https://github.com/Freescale/kernel-module-imx-gpu-viv 130 /dev/galcore rw, 131 132 # OpenCL ICD files 133 /etc/OpenCL/vendors/ r, 134 /etc/OpenCL/vendors/** r, 135 136 # Parallels guest tools 3D acceleration (video toolgate) 137 @{PROC}/driver/prl_vtg rw, 138 139 # /sys/devices 140 /sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/config r, 141 /sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/revision r, 142 /sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/resource r, 143 /sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/irq r, 144 /sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/boot_vga r, 145 /sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}class r, 146 /sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}device r, 147 /sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}vendor r, 148 /sys/devices/**/drm{,_dp_aux_dev}/** r, 149 150 # FIXME: this is an information leak and snapd should instead query udev for 151 # the specific accesses associated with the above devices. 152 /sys/bus/pci/devices/ r, 153 /sys/bus/platform/devices/soc:gpu/ r, 154 /run/udev/data/+drm:card* r, 155 /run/udev/data/+pci:[0-9a-f]* r, 156 /run/udev/data/+platform:soc:gpu* r, 157 158 # FIXME: for each device in /dev that this policy references, lookup the 159 # device type, major and minor and create rules of this form: 160 # /run/udev/data/<type><major>:<minor> r, 161 # For now, allow 'c'haracter devices and 'b'lock devices based on 162 # https://www.kernel.org/doc/Documentation/devices.txt 163 /run/udev/data/c226:[0-9]* r, # 226 drm 164 165 # From https://bugs.launchpad.net/snapd/+bug/1862832 166 /run/nvidia-xdriver-* rw, 167 unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"), 168 ` 169 170 // Some nvidia modules don't use sysfs (therefore they can't be udev tagged) and 171 // will be added by snap-confine. 172 var openglConnectedPlugUDev = []string{ 173 `SUBSYSTEM=="drm", KERNEL=="card[0-9]*"`, 174 `KERNEL=="vchiq"`, 175 `KERNEL=="vcsm-cma"`, 176 `KERNEL=="renderD[0-9]*"`, 177 `KERNEL=="nvhost-*"`, 178 `KERNEL=="nvmap"`, 179 `KERNEL=="tegra_dc_ctrl"`, 180 `KERNEL=="tegra_dc_[0-9]*"`, 181 `KERNEL=="pvr_sync"`, 182 `KERNEL=="mali[0-9]*"`, 183 `KERNEL=="dma_buf_te"`, 184 `KERNEL=="galcore"`, 185 } 186 187 func init() { 188 registerIface(&commonInterface{ 189 name: "opengl", 190 summary: openglSummary, 191 implicitOnCore: true, 192 implicitOnClassic: true, 193 baseDeclarationSlots: openglBaseDeclarationSlots, 194 connectedPlugAppArmor: openglConnectedPlugAppArmor, 195 connectedPlugUDev: openglConnectedPlugUDev, 196 }) 197 }