/dev/nvidia* is world writable

[Kees Cook]

leaving /dev/nvidia* world-writable exposes systems to future vulnerabilities even from remote users. This file should be limited to the console user instead (usually done with dynamic file ACLs).

[Alex Murray (alexmurray)]

More info here: http://nvidia.custhelp.com/app/answers/detail/a_id/3109

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Maarten Lankhorst (mlankhorst)]

Easy workaround would be to change /lib/udev/rules.d/50-udev-default.rules :

KERNEL=="nvidia*|nvidiactl*", GROUP="video", MODE="0660"

However that requires current user to be in the video group, and that will probably cause a lot of issues on its own, since by default users are not part of the video group, and probably not a change you want to push except in a next major release.

[Marc Deslauriers (mdeslaur)]

How about adding nvidia* to /lib/udev/rules.d/70-udev-acl.rules and getting permissions added by consolekit?

[Marc Deslauriers (mdeslaur)]

OK, using udev doesn't work, as the device nodes and permissions are created by the binary driver when X starts.

See:
http://us.download.nvidia.com/XFree86/Linux-x86/295.59/README/faq.html

[Marc Deslauriers (mdeslaur)]

Some info here:

http://www.openwall.com/lists/oss-security/2012/08/01/9