[cfarm-users] cfarm109 GPU access problem

[Gregor Riepl]

> Given the names of those groups and the facts that they are used for access control on those device nodes, I suspect that 'video' and 'render' group membership are probably exactly the intended permissions to use GPGPU on that system.

I was wondering about that... and it seems strange that /dev/nvmap has a different group assigned than /dev/dri*

The render group isn't mentioned in the Debian base-passwd policy[1], but I found this: [2]

> Traditionally, the video group is used to control access to video devices, including graphics cards and video capture devices. The render group is more recent and specifically controls access to GPU rendering capabilities through Direct Rendering Manager (DRM) render nodes.

Probably something that should be improved in general? Doesn't make a lot of sense to me that video input and output devices use the same permissions. Or perhaps, if the system is headless, it shouldn't require users to be members of a video input/output group to use GPU capabilities.

[1] https://www.debian.org/doc/manuals/securing-debian-manual/ch12.en.html#idm4686
[2] https://rocm.docs.amd.com/projects/install-on-linux/en/latest/install/prerequisites.html#using-group-membership