unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
@ 2020-11-15  0:51 Daniel Brooks
  2020-11-15 14:56 ` Marius Bakke
  2020-11-15 20:19 ` Ludovic Courtès
  0 siblings, 2 replies; 12+ messages in thread
From: Daniel Brooks @ 2020-11-15  0:51 UTC (permalink / raw)
  To: 44649

It should instead include the guix-daemon.cil file which was built from
it. The .in file has unsubstituted variabels in it which make it useless
as an SELinux policy.




^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-15  0:51 bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in Daniel Brooks
@ 2020-11-15 14:56 ` Marius Bakke
  2020-11-15 15:08   ` Daniel Brooks
  2020-11-15 20:19 ` Ludovic Courtès
  1 sibling, 1 reply; 12+ messages in thread
From: Marius Bakke @ 2020-11-15 14:56 UTC (permalink / raw)
  To: Daniel Brooks, 44649


[-- Attachment #1.1: Type: text/plain, Size: 439 bytes --]

Daniel Brooks <db48x@db48x.net> writes:

> It should instead include the guix-daemon.cil file which was built from
> it. The .in file has unsubstituted variabels in it which make it useless
> as an SELinux policy.

Actually I think both should be included.  The processed file will work
for 99% of users, and the template is needed for the 1% that use a
different store directory.

@Ludo: WDYT about the attached patch for version-1.2.0?


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: 0001-maint-Install-the-processed-SELinux-policy-file-in-a.patch --]
[-- Type: text/x-patch, Size: 1069 bytes --]

From 8b77d853a4c9503df61fb75190d562206d1de1d2 Mon Sep 17 00:00:00 2001
From: Marius Bakke <marius@gnu.org>
Date: Sun, 15 Nov 2020 15:56:04 +0100
Subject: [PATCH] maint: Install the processed SELinux policy file in addition
 to the template.

This fixes <https://bugs.gnu.org/44649>.
Reported by Daniel Brooks <db48x@db48x.net>.

* Makefile.am (dist_selinux_policy_DATA): New target.
---
 Makefile.am | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index 5b84d74f08..4c061db3ca 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -561,8 +561,10 @@ dist_zshcompletion_DATA = etc/completion/zsh/_guix
 # Fish completion file.
 dist_fishcompletion_DATA = etc/completion/fish/guix.fish
 
-# SELinux policy
+# SELinux policy.  Install both the template and the compiled version so
+# it works "out of the box", but can be rebuilt as necessary.
 nodist_selinux_policy_DATA = etc/guix-daemon.cil.in
+dist_selinux_policy_DATA = etc/guix-daemon.cil
 
 EXTRA_DIST +=						\
   HACKING						\
-- 
2.29.2


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply related	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-15 14:56 ` Marius Bakke
@ 2020-11-15 15:08   ` Daniel Brooks
  2020-11-15 21:02     ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
  0 siblings, 1 reply; 12+ messages in thread
From: Daniel Brooks @ 2020-11-15 15:08 UTC (permalink / raw)
  To: Marius Bakke; +Cc: 44649

Marius Bakke <marius@gnu.org> writes:

> Actually I think both should be included.  The processed file will work
> for 99% of users, and the template is needed for the 1% that use a
> different store directory.

Fair enough.




^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-15  0:51 bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in Daniel Brooks
  2020-11-15 14:56 ` Marius Bakke
@ 2020-11-15 20:19 ` Ludovic Courtès
  2020-11-15 21:24   ` Daniel Brooks
  2020-11-15 22:26   ` Marius Bakke
  1 sibling, 2 replies; 12+ messages in thread
From: Ludovic Courtès @ 2020-11-15 20:19 UTC (permalink / raw)
  To: Daniel Brooks; +Cc: 44649

Hi,

Daniel Brooks <db48x@db48x.net> skribis:

> It should instead include the guix-daemon.cil file which was built from
> it. The .in file has unsubstituted variabels in it which make it useless
> as an SELinux policy.

Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
your configuration.  What’s wrong with that?

Marius: common practice is to not include instantiated templates; we
wouldn’t use templates in the first place if contents were always the
same.  :-)

Thanks,
Ludo’.




^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-15 15:08   ` Daniel Brooks
@ 2020-11-15 21:02     ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
  0 siblings, 0 replies; 12+ messages in thread
From: Tobias Geerinckx-Rice via Bug reports for GNU Guix @ 2020-11-15 21:02 UTC (permalink / raw)
  To: Daniel Brooks; +Cc: 44649, marius

[-- Attachment #1: Type: text/plain, Size: 465 bytes --]

Daniel Brooks 写道:
> Marius Bakke <marius@gnu.org> writes:
>
>> Actually I think both should be included.  The processed file 
>> will work
>> for 99% of users, and the template is needed for the 1% that 
>> use a
>> different store directory.
>
> Fair enough.

Is a pre-generated .cil file required to run ./configure at all on 
some systems?  How's it different from, say, the Makefile which is 
also generated later?

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]

^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-15 20:19 ` Ludovic Courtès
@ 2020-11-15 21:24   ` Daniel Brooks
  2020-11-16  8:12     ` Ludovic Courtès
  2020-11-15 22:26   ` Marius Bakke
  1 sibling, 1 reply; 12+ messages in thread
From: Daniel Brooks @ 2020-11-15 21:24 UTC (permalink / raw)
  To: Ludovic Courtès; +Cc: 44649

Ludovic Courtès <ludo@gnu.org> writes:

> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
> your configuration.  What’s wrong with that?
>
> Marius: common practice is to not include instantiated templates; we
> wouldn’t use templates in the first place if contents were always the
> same.  :-)

That's true; I'd forgotten about that. The reason I mention it is that
it would be nice if guix-install.sh could set up the selinux policy. I
guess this is the only step that would need to run configure.

db48x




^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-15 20:19 ` Ludovic Courtès
  2020-11-15 21:24   ` Daniel Brooks
@ 2020-11-15 22:26   ` Marius Bakke
  1 sibling, 0 replies; 12+ messages in thread
From: Marius Bakke @ 2020-11-15 22:26 UTC (permalink / raw)
  To: Ludovic Courtès, Daniel Brooks; +Cc: 44649-done

[-- Attachment #1: Type: text/plain, Size: 793 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> Hi,
>
> Daniel Brooks <db48x@db48x.net> skribis:
>
>> It should instead include the guix-daemon.cil file which was built from
>> it. The .in file has unsubstituted variabels in it which make it useless
>> as an SELinux policy.
>
> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
> your configuration.  What’s wrong with that?
>
> Marius: common practice is to not include instantiated templates; we
> wouldn’t use templates in the first place if contents were always the
> same.  :-)

Yes indeed; somehow I thought the bootstrapped tarball also had run
"configure" with the common options, but obviously that's incorrect.

Closing this bug, as there is no reason to special-case this one file.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-15 21:24   ` Daniel Brooks
@ 2020-11-16  8:12     ` Ludovic Courtès
  2020-11-16 12:12       ` Daniel Brooks
  0 siblings, 1 reply; 12+ messages in thread
From: Ludovic Courtès @ 2020-11-16  8:12 UTC (permalink / raw)
  To: Daniel Brooks; +Cc: 44649

Hi Daniel,

Daniel Brooks <db48x@db48x.net> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
>> your configuration.  What’s wrong with that?
>>
>> Marius: common practice is to not include instantiated templates; we
>> wouldn’t use templates in the first place if contents were always the
>> same.  :-)
>
> That's true; I'd forgotten about that. The reason I mention it is that
> it would be nice if guix-install.sh could set up the selinux policy. I
> guess this is the only step that would need to run configure.

Good point!  The installed ‘guix’ has that file under
share/selinux/guix-daemon.cil, so perhaps the script could copy it from
there?

HTH,
Ludo’.




^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-16  8:12     ` Ludovic Courtès
@ 2020-11-16 12:12       ` Daniel Brooks
  2020-11-16 12:53         ` Ludovic Courtès
  0 siblings, 1 reply; 12+ messages in thread
From: Daniel Brooks @ 2020-11-16 12:12 UTC (permalink / raw)
  To: Ludovic Courtès; +Cc: 44649

Ludovic Courtès <ludo@gnu.org> writes:

> Good point!  The installed ‘guix’ has that file under
> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
> there?

It only has it if you run configure first.

db48x




^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-16 12:12       ` Daniel Brooks
@ 2020-11-16 12:53         ` Ludovic Courtès
  2020-11-16 13:15           ` Daniel Brooks
  0 siblings, 1 reply; 12+ messages in thread
From: Ludovic Courtès @ 2020-11-16 12:53 UTC (permalink / raw)
  To: Daniel Brooks; +Cc: 44649

Daniel Brooks <db48x@db48x.net> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Good point!  The installed ‘guix’ has that file under
>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>> there?
>
> It only has it if you run configure first.

“The installed ‘guix’” here refers to the one
/var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.

HTH,
Ludo’.




^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-16 12:53         ` Ludovic Courtès
@ 2020-11-16 13:15           ` Daniel Brooks
  2020-11-16 16:15             ` Ludovic Courtès
  0 siblings, 1 reply; 12+ messages in thread
From: Daniel Brooks @ 2020-11-16 13:15 UTC (permalink / raw)
  To: Ludovic Courtès; +Cc: 44649

Ludovic Courtès <ludo@gnu.org> writes:

>>> Good point!  The installed ‘guix’ has that file under
>>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>>> there?
>>
>> It only has it if you run configure first.
>
> “The installed ‘guix’” here refers to the one
> /var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.

It only has what's in the tarball, which is just guix-daemon.cil.in.

db48x




^ permalink raw reply	[flat|nested] 12+ messages in thread

* bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
  2020-11-16 13:15           ` Daniel Brooks
@ 2020-11-16 16:15             ` Ludovic Courtès
  0 siblings, 0 replies; 12+ messages in thread
From: Ludovic Courtès @ 2020-11-16 16:15 UTC (permalink / raw)
  To: Daniel Brooks; +Cc: 44649-done

Daniel Brooks <db48x@db48x.net> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>>>> Good point!  The installed ‘guix’ has that file under
>>>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>>>> there?
>>>
>>> It only has it if you run configure first.
>>
>> “The installed ‘guix’” here refers to the one
>> /var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.
>
> It only has what's in the tarball, which is just guix-daemon.cil.in.

Oh, got it; now that’s a bug, sorry if I had misunderstood all along!

Now fixed in d4031410375834349bc0d56630be86b076a1d704.

Ludo’.




^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2020-11-16 16:42 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-15  0:51 bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in Daniel Brooks
2020-11-15 14:56 ` Marius Bakke
2020-11-15 15:08   ` Daniel Brooks
2020-11-15 21:02     ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2020-11-15 20:19 ` Ludovic Courtès
2020-11-15 21:24   ` Daniel Brooks
2020-11-16  8:12     ` Ludovic Courtès
2020-11-16 12:12       ` Daniel Brooks
2020-11-16 12:53         ` Ludovic Courtès
2020-11-16 13:15           ` Daniel Brooks
2020-11-16 16:15             ` Ludovic Courtès
2020-11-15 22:26   ` Marius Bakke

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).