bottlerocket-os / bottlerocket-os/bottlerocket
Unable to use lockdown mode with NVIDIA module on bottlerocket
- Dominant language
- Rust
- Stars
- 9.7k
- Forks
- 586
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 11
Description
When attempting to load the NVIDIA kernel module on a Bottlerocket AMI using kernel lockdown = `integrity`, errors like the following are produced:
```
5.879228] driverdog[2088]: 23:10:41 [ERROR] '/usr/bin/modprobe' failed - stderr: modprobe: ERROR: could not insert 'nvidia': Operation not permitted
[ 5.881035] driverdog[2088]: modprobe: ERROR: could not insert 'nvidia_uvm': Operation not permitted
[ 5.882187] driverdog[2088]: modprobe: ERROR: could not insert 'nvidia_modeset': Operation not permitted
[FAILED] Failed to start Load additional kernel modules.
See 'systemctl status load-kernel-modules.service' for details.
[DEPEND] Dependency failed for Bottlerocket initial configuration complete.
[DEPEND] Dependency failed for Isolates configured.target.
```
This was tested on the following versions in us-east-1: 1.30 (`ami-0c2f741e432159b2c`), 1.29 (`ami-06033e6f46c64c7db`), and 1.20 (`ami-046b028e6b00a3938`).
Sef-signing also does not work as a workaround - rather, we receive validation rejected.
Contributor guide
Assessment
This issue has not been assessed yet.