From e623b3e2167568fb4702809a9f1d6d521b4fef05 Mon Sep 17 00:00:00 2001 From: Callum Law Date: Fri, 19 Jun 2026 21:10:40 +1200 Subject: [PATCH] Compositor: Allow NVIDIA GPU access in sandbox --- Services/Compositor/SandboxLinux.cpp | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/Services/Compositor/SandboxLinux.cpp b/Services/Compositor/SandboxLinux.cpp index 5f28891ae6..e83ee51de9 100644 --- a/Services/Compositor/SandboxLinux.cpp +++ b/Services/Compositor/SandboxLinux.cpp @@ -39,6 +39,20 @@ ErrorOr apply_sandbox() TRY(Sandbox::add_landlock_path_if_exists(paths, path, Sandbox::LandlockPath::Access::ReadOnly)); } + TRY(Sandbox::add_landlock_path_if_exists(paths, "/dev/nvidiactl"sv, Sandbox::LandlockPath::Access::ReadWrite)); + + // NB: Add all of the primary nvidia device files (e.g. /dev/nvidia0, /dev/nvidia1, etc). + auto flags = static_cast(Core::DirIterator::SkipDots | Core::DirIterator::NoStat); + TRY(Core::Directory::for_each_entry("/dev"sv, flags, [&](Core::DirectoryEntry const& entry, Core::Directory const&) -> ErrorOr { + if (entry.name.starts_with("nvidia"sv)) { + auto suffix = entry.name.substring_view(6); + if (!suffix.is_empty() && all_of(suffix, is_ascii_digit)) + TRY(Sandbox::add_landlock_path_if_exists(paths, TRY(String::formatted("/dev/{}", entry.name)), Sandbox::LandlockPath::Access::ReadWrite)); + } + + return IterationDecision::Continue; + })); + auto mesa_shader_cache_path = Core::Environment::get("MESA_SHADER_CACHE_DIR"sv) .map([](auto path) { return path.to_byte_string(); }) .value_or_lazy_evaluated([] { return ByteString::formatted("{}/mesa_shader_cache", Core::StandardPaths::cache_directory()); });