nvidia-container.te

# /usr/share/selinux/devel/include

policy_module(nvidia-container, 0.1)

gen_require(`
        type container_runtime_tmpfs_t;
        type xserver_exec_t;
')

container_domain_template(nvidia_container)

# --- hanging forever without this
allow nvidia_container_t container_runtime_t:process sigchld;

# --- podman/docker
getattr_dirs_pattern(nvidia_container_t, container_runtime_tmpfs_t, container_runtime_tmpfs_t)
list_dirs_pattern(nvidia_container_t, container_runtime_tmpfs_t, container_runtime_tmpfs_t)
read_files_pattern(nvidia_container_t, container_runtime_tmpfs_t, container_runtime_tmpfs_t)

# --- running nvidia-smi
allow nvidia_container_t xserver_exec_t:file { entrypoint execute getattr };

# --- allow nvidia_container_t xserver_misc_device_t:chr_file { getattr ioctl open read write };
# --- alloc mem, ... /dev/nvidia*
dev_rw_xserver_misc(nvidia_container_t)