Hi Laurent,
Thank you for asking me to verify! I created a fresh Debian
Testing VM installation with GNOME desktop and tested immediately
after first login:
$ groups
kristjan cdrom floppy audio dip video plugdev users netdev
scanner bluetooth lpadmin
# Note: render is NOT in the list
$ getent group render
render:x:991:
# render group exists but is empty
$ getfacl /dev/dri/renderD128
user::rw-
user:kristjan:rw- <-- ACL automatically set!
group::rw-
$ loginctl show-session ... | grep Type
Type=wayland
So you're absolutely correct: logind is automatically setting ACLs
for the active user, making group membership unnecessary. The
system works as designed.
My apologies for the false alarm - the original Vulkan error was
unrelated (GPU driver issue with my AMD RX 9060 XT). The ACL-based
approach works perfectly out-of-the-box.
Feel free to close this bug as "works as designed".
Best regards,
Kristjan
Le 28/12/25 à 11:50, Cyril Brulebois a écrit :
Hi Kristjan,This is quite weird as with a default installation (using systemd and logind) a local user should have all the necessary rights and everything should work out-of-the-box.
And thanks for the report.
Kristjan <[email protected]> (2025-12-28):
After a fresh Debian Testing installation (installer build 20250803+deb13u1)
with GNOME desktop (task-gnome-desktop), the created user was not added to
the 'render' group, although the group exists in the system.
What led up to the situation?
* Standard Debian Testing netinstall with GNOME desktop task selected
* User created during installation process
What was the outcome?
* User is member of: cdrom floppy audio dip video plugdev users netdev
scanner bluetooth lpadmin input
* The 'render' group exists (GID 992) but is completely empty
* Vulkan applications fail with errors like:
"Gdk-WARNING: Vulkan: Could not open device /dev/dri/renderD128:
Invalid argument (VK_ERROR_INCOMPATIBLE_DRIVER)"
Did you check that your user is properly opening a logind session (with loginctl)?
What outcome did you expect?
* Desktop users should be automatically added to the 'render' group during
installation, similar to how they are added to the 'video' group
* The 'render' group is required for GPU computing and Vulkan applications
to access /dev/dri/renderD* devices
[...]
Over the past few years, the trend has been to shrink the number ofYes I still think we have to many default groups already
groups set up via the installer, because other components can do that
automatically (and not just for the first user).
I'm cc-ing Laurent, who contributed such changes.
