test(core): update Orin CDI policy baseline

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

crates/openshell-core/src/cdi_linux.rs

@@ -450,7 +450,7 @@ mod tests {
     #[derive(serde::Serialize)]
     struct PolicyBaseline<'a> {
         device_node_paths: &'a [String],
-        read_only_mount_paths: &'a [String],
+        library_directories: &'a [String],
         read_write_mount_paths: &'a [String],
         additional_gids: &'a [u32],
     }
@@ -472,7 +472,7 @@ mod tests {
         .unwrap();
         let baseline = PolicyBaseline {
             device_node_paths: &requirements.device_node_paths,
-            read_only_mount_paths: &requirements.read_only_mount_paths,
+            library_directories: &requirements.library_directories,
             read_write_mount_paths: &requirements.read_write_mount_paths,
             additional_gids: &requirements.additional_gids,
         };

crates/openshell-core/testdata/orin-nvidia-policy-baseline.json

@@ -33,214 +33,10 @@
     "/dev/nvsciipc",
     "/dev/v4l2-nvdec"
   ],
-  "read_only_mount_paths": [
-    "/dev/dri/by-path",
-    "/etc/nv_tegra_release",
-    "/etc/vulkansc/icd.d/nvidia_icd_vksc.json",
-    "/usr/bin/nvidia-cuda-mps-control",
-    "/usr/bin/nvidia-cuda-mps-server",
-    "/usr/lib/aarch64-linux-gnu/nvidia/ld.so.conf",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libGLX_nvidia.so.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libVkLayer_json_gen.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libVkSCLayer_khronos_validation.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libcuda.so.1.1",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libjetsonpower.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvargus.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvargus_socketclient.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvargus_socketserver.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvbuf_fdmap.so.1.0.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurface.so.1.0.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurftransform.so.1.0.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcam_imageencoder.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcameratools.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcamerautils.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcamlog.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcamv4l2.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcapture.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcolorutil.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcucompat.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcudla.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvcuvidv4l2.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvdc.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvddk_2d_v2.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvddk_vic.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvdecode2eglimage.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvdla_runtime.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvdsbufferpool.so.1.0.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnveventlib.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvexif.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvfnet.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvfnetstoredefog.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvfnetstorehdfx.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvfusacap.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvfusacapinterface.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_boot.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_camera.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_force.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_generic.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_gpucompute.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_graphics.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_il.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_spincircle.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_tbc.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvgov_ui.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvid_mapper.so.1.0.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-allocator.so.1",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-gbm.so.1.1.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-wayland.so.1.1.11",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-eglcore.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glcore.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glsi.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glvkspirv.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-gpucomp.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-kms.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-ml.so.1",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-nvvm.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-ptxjitcompiler.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-rmapi-tegra.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-rtcore.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-tls.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-vksc-core.so.540.5.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvimp.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvisp.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvisp_utils.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvisppg.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvjpeg.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia2d.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_2d.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_dla.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_eglstream.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ide_parser.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ide_sci.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_iep_sci.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ijpd_sci.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ijpe_sci.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_iofa_sci.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_isp_ext.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_tensor.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmedialdc.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmm.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmm_contentpipe.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmm_parser.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmm_utils.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_image.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_utils.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_video.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvodm_imager.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvofsdk.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvomx.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvomxilclient.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvos.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvosd.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvparser.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvphs.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvphsd.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvplayfair.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvpva.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvpva_algorithms.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvpvaintf.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvpvaumd.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvrm_chip.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvrm_gpu.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvrm_host1x.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvrm_mem.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvrm_stream.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvrm_surface.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvrm_sync.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvscf.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvscibuf.so.1",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvscicommon.so.1",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvscievent.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvsciipc.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvscistream.so.1",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvscisync.so.1",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvsocsys.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvtegrahv.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvtracebuf.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvtvmr.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvtvmr_2d.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvv4l2.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvv4lconvert.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvvic.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvvideo.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libnvvideoencode_ppe.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libsensors.hal-client.nvs.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libsensors.l4t.no_fusion.nvs.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libsensors_hal.nvs.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libtegrav4l2.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libtegrawfd.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvargus.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvcuvidvideocodec.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvvideocodec.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libvulkansc.so.1.0.10",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libwayland-client.so.0.22.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libwayland-cursor.so.0.22.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libwayland-egl.so.1.22.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/libwayland-server.so.0.22.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/nvidia_icd.json",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/EGLWLInputEventExample",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/EGLWLMockNavigation",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/LayerManagerControl",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/color-lcms.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/desktop-shell.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/drm-backend.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/fullscreen-shell.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/gl-renderer.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/headless-backend.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/hmi-controller.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/ivi-controller.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/ivi-shell.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmClient.so.2.3.2",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmCommon.so.2.3.2",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmControl.so.2.3.2",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmInput.so.2.3.2",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libweston-13.so.0",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/simple-weston-client",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/spring-tool",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/wayland-backend.so",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-calibrator",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-clickdot",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-cliptest",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-content-protection",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-debug",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-desktop-shell",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-dnd",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-eventdemo",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-flower",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-fullscreen",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-image",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-ivi-shell-user-interface",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-keyboard",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-multi-resource",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-presentation-shm",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-resizor",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-scaler",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-screenshooter",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-damage",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-egl",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-egldevice",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-feedback",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-egl",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-im",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-shm",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-touch",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-smoke",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-stacking",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-subsurfaces",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-tablet",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-terminal",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-touch-calibrator",
-    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-transformed",
-    "/usr/lib/aarch64-linux-gnu/tegra-egl/ld.so.conf",
-    "/usr/lib/aarch64-linux-gnu/tegra-egl/libEGL_nvidia.so.0",
-    "/usr/lib/aarch64-linux-gnu/tegra-egl/libGLESv1_CM_nvidia.so.1",
-    "/usr/lib/aarch64-linux-gnu/tegra-egl/libGLESv2_nvidia.so.2",
-    "/usr/lib/aarch64-linux-gnu/tegra-egl/nvidia.json",
-    "/usr/lib/firmware/tegra23x/nvhost_nvdec050_desc_prod.bin",
-    "/usr/sbin/nvidia-smi"
+  "library_directories": [
+    "/usr/lib/aarch64-linux-gnu/nvidia",
+    "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0",
+    "/usr/lib/aarch64-linux-gnu/tegra-egl"
   ],
   "read_write_mount_paths": [],
   "additional_gids": [