2 files changed, 14 insertions, 2 deletions

diff --git a/etc/profile-m-z/noprofile.profile b/etc/profile-m-z/noprofile.profile
index 7d0e01d98..c2e4999ea 100644
--- a/etc/profile-m-z/noprofile.profile
+++ b/etc/profile-m-z/noprofile.profile
@@ -15,6 +15,8 @@
 
 noblacklist /sys/fs
 noblacklist /sys/module
+nowhitelist /sys/module/nvidia*
+ignore read-only /sys/module/nvidia*
 
 allow-debuggers
 allusers
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index cdad5e220..abef85515 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -743,10 +743,20 @@ void fs_proc_sys_dev_boot(void) {
 
         disable_file(BLACKLIST_FILE, "/sys/firmware");
         disable_file(BLACKLIST_FILE, "/sys/hypervisor");
-        { // allow user access to some directories in /sys/ by specifying 'noblacklist' option
-                profile_add("blacklist /sys/fs");
+
+        // Soft-block some paths in /sys/ (can be undone in profiles).
+        profile_add("blacklist /sys/fs");
+
+        // Hardware acceleration with the nvidia proprietary driver may fail
+        // without access to these paths (see #6372).
+        if (access("/dev/nvidiactl", R_OK) == 0 && arg_no3d == 0) {
+                profile_add("whitelist /sys/module/nvidia*");
+                profile_add("read-only /sys/module/nvidia*");
+        }
+        else {
                 profile_add("blacklist /sys/module");
         }
+
         disable_file(BLACKLIST_FILE, "/sys/power");
         disable_file(BLACKLIST_FILE, "/sys/kernel/debug");
         disable_file(BLACKLIST_FILE, "/sys/kernel/vmcoreinfo");