Frank
055fafc233
The first revision guarded the kfd line with SUBSYSTEM=="misc", which never matches (misc-class devices carry no subsystem for udev matching), so the rule was read but never fired and /dev/kfd stayed 0660 root:render. Name-only match applies 0666 on creation and on trigger. Also fixes test-changed.sh to exit 0 when changed paths map to zero tests (udev rules are mapped-but-untestable) instead of invoking bats with an empty selection.
22 lines
1.3 KiB
Plaintext
22 lines
1.3 KiB
Plaintext
# /etc/udev/rules.d/99-comfyui-gpu-access.rules
|
|
#
|
|
# Why world-writable compute nodes: the comfyui container is spawned by a
|
|
# systemd user unit (comfyui.service, Type=oneshot). User-unit processes are
|
|
# spawned by the user manager with NO supplementary groups, so any spawn path
|
|
# through systemd loses `render`/`video` membership regardless of how the
|
|
# container is launched (keep-groups and named group_add both depend on the
|
|
# spawning process already holding the group — verified 2026-08-31: keep-groups
|
|
# preserved an empty group list under the user manager and /dev/kfd open still
|
|
# failed with EACCES). A mode that grants access to "everyone in this uid
|
|
# domain" is the only spawn-context-independent option short of running the
|
|
# stack rootful.
|
|
#
|
|
# Blast radius: any local process (every container here runs as the same uid
|
|
# domain) can already ptrace the GPU userspace through an existing holder's
|
|
# fd inheritance; on a private single-administrator home server this trades a
|
|
# capability gate that could never be held by the intended user anyway.
|
|
# Note the missing SUBSYSTEM= guard on the kfd line: misc-class devices have no
|
|
# subsystem for udev matching, so a SUBSYSTEM=="misc" guard never matches.
|
|
KERNEL=="kfd", MODE="0666"
|
|
KERNEL=="renderD*", SUBSYSTEM=="drm", MODE="0666"
|