<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Simon,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you so much for your prompt inputs! They were all very useful information. You've answered all the questions we have so far.
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regards,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Winnie<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Simon McVittie <smcv@collabora.com><br>
<b>Sent:</b> February 12, 2020 5:36 AM<br>
<b>To:</b> Winnie Poon <winniepoon_home@hotmail.com><br>
<b>Cc:</b> flatpak <flatpak@lists.freedesktop.org><br>
<b>Subject:</b> Re: what exactly does --device=dri open?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On Tue, 11 Feb 2020 at 21:37:29 +0000, Winnie Poon wrote:<br>
> I would like to understand more what this --device=dri does.<br>
<br>
For the most correct version, without anyone else's interpretation<br>
(not even mine), see the flatpak source code. (common/flatpak-run.c,<br>
look for FLATPAK_CONTEXT_DEVICE_DRI)<br>
<br>
This currently means the /dev/dri directory (used by GPUs with open-source<br>
drivers, most commonly AMD and Intel GPUs on PC hardware), plus its<br>
closest equivalents in the proprietary NVIDIA and Mali drivers.<br>
<br>
> We did open a hole "--device=dri" for OpenGL to work, but it looks<br>
> like this --device=dri also opens up a lot of things inside the sandbox. <br>
<br>
It provides working DRI GPU drivers (for OpenGL, OpenGL ES, OpenCL,<br>
Vulkan, VA-API, VDPAU and similar things with open-source drivers),<br>
plus the closest equivalents in some proprietary GPU drivers (again for<br>
OpenGL, OpenCL and so on).<br>
<br>
> It seems like with this hole "--device=dri", from inside the sandbox we can<br>
> directly access the GPU<br>
<br>
Well, yes, that's exactly what DRI is for - it's the Direct Rendering<br>
Interface, for direct access to GPUs.<br>
<br>
> Is there a way to open up a "smaller" hole?<br>
<br>
Not if you want accelerated OpenGL, etc. to work.<br>
<br>
If lower-performance/less-power-efficient software OpenGL (llvmpipe)<br>
is acceptable to you, you can disable --device=dri. In this case, other<br>
things that rely on GPU access (OpenCL, Vulkan, VA-API, etc.) will<br>
either run on the CPU with lower performance or power-efficiency, or<br>
not work at all, depending whether they have a software fallback path<br>
like OpenGL does.<br>
<br>
> Is it safe/secure to use "--device=dri" which seems to break open the sandbox<br>
> and allow the app to reach out to do a lot of things as if it's outside the<br>
> sandbox?<br>
<br>
Only you can say what is an acceptable level of risk/attack surface for<br>
your use-cases.<br>
<br>
smcv<br>
</div>
</span></font></div>
</div>
</body>
</html>