-
Notifications
You must be signed in to change notification settings - Fork 557
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
hashcat: failure with private-dev & private-bin #6364
Comments
Related: #6148 |
Thanks for reporting. Sadly my current hardware is partly broken so I can't reliably test hashcat. I do have a few questions/remarks.
Do you have binaries installed under that After installing the hashcat package and running
The referenced Regards |
Hashcat is installed to
Yes, this directory exists on my box, and contains the potfile, session data, etc. |
Thanks. We'll better keep that in then for backward-compatibility. |
Apparently hashcat needs access to this device for hardware acceleration on AMD gpus and `private-dev` currently breaks that (see netblue30#6364). It seems to be used by the "amdgpu" and "amdkfd" Linux kernel drivers and as with /dev/dri/renderD128, this file is owned by the "render" group. Relevant udev rules from /usr/lib/udev/rules.d/50-udev-default.rules: SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="0666" SUBSYSTEM=="kfd", GROUP="render", MODE="0666" SUBSYSTEM=="accel", GROUP="render", MODE="0666" Environment: udev 255.6-1 on Artix Linux. Reported-by: @schrotthaufen
Apparently hashcat needs access to this device for hardware acceleration on AMD gpus and `private-dev` currently breaks that (see #6364). It seems to be used by the "amdgpu" and "amdkfd" Linux kernel drivers and as with /dev/dri/renderD128, this file is owned by the "render" group. Relevant udev rules from /usr/lib/udev/rules.d/50-udev-default.rules: SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="0666" SUBSYSTEM=="kfd", GROUP="render", MODE="0666" SUBSYSTEM=="accel", GROUP="render", MODE="0666" Environment: udev 255.6-1 on Artix Linux. Reported-by: @schrotthaufen
Description
The default profile for hashcat uses, private-bin, and private-dev, which break hashcat.
I have a AMD RX 7900 XT GPU.
Steps to Reproduce
LC_ALL=C firejail hashcat -b -m 1000
Expected behavior
hashcat starts working.
Actual behavior
private-bin hashcat
: hashcat throws an error, and quits:/usr/local/bin/OpenCL/: No such file or directory
private-dev
: hashcat throws an error, and quits:No devices found/left.
Behavior without a profile
hashcat works as expected.
Additional context
I think
/dev/kfd
is required to makeprivate-dev
work, but if I pass--whitelist=/dev/kfd
, the/dev/
directory is empty.Environment
Compile time support:
Checklist
/usr/bin/vlc
) "fixes" it).https://github.com/netblue30/firejail/issues/1139
)browser-allow-drm yes
/browser-disable-u2f no
infirejail.config
to allow DRM/U2F in browsers.--profile=PROFILENAME
to set the right profile. (Only relevant for AppImages)The text was updated successfully, but these errors were encountered: