Nvidia is recognized by sysmaint but not by user

Development
1

Steps to install Nvidia:

Then nvidia will be recognized when running sudo nvidia-smi on sysmaint side.

But on user side nvidia is not usable by user because nvidia is within admin level not user.

2

Side story:

I have successfully made vfio to work in KS:

Nvidia → vfio (user level) → Tools like KVM (VMs) can use Nvidia.

(Needded: Detachment of Nvidia (dGPU) from being used by the system (root). Only rely on the CPU Internal GPU (iGPU).)

So likely for whats going on is that the username user cant deal with nvidia because of permission issue.

3

yeah thats the user vs sysmaint split. nvidia-smi working in sysmaint just means the kernel module loaded. user still needs the /dev/nvidia nodes and usually video/render. check ls -l /dev/nvidia as user and id. if the nodes arent there the user session never got the nvidia userspace bits.

4

Turns out this is because nvidia-modprobe is having its SUID bit stripped by permission-hardener. NVIDIA’s driver can’t create some device files itself due to GPL compliance issues (probably GPL symbols strikes again), so instead they have a SUID userland helper to do it, see Device Nodes and Capabilities — NVIDIA Multi-Instance GPU User Guide.

It might make sense to enable an exception in permission-hardener for this, although I’m a bit hesitant to do that given that it’s a proprietary and therefore very difficult-to-audit binary.

2 Likes
5

Documented how to manually whitelist the binary:

Also discovered that the version of NVIDIA’s drivers in Debian Trixie is sorely out of date and added an extra security warning to that wiki page.

1 Like
6

Will test and report back.

(You can test it on KVM (passing GPU to the VM) or external hardware just for testing (Install KS on the hardware, test then you can format it)).

1 Like