unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
* bug#39172: SElinux guix-daemon.cil file
@ 2020-01-18 15:40 Matt Wette
  2020-01-20  9:13 ` Ludovic Courtès
  0 siblings, 1 reply; 5+ messages in thread
From: Matt Wette @ 2020-01-18 15:40 UTC (permalink / raw)
  To: 39172

Hi All,

I appologize for the formatting.  I use tbird and I can't find a way to 
do plain-text mode.

I'm trying to get guix-1.0.1 running on Fedora-30 with its default 
SElinux set up.
I found (hint from 
https://lists.gnu.org/archive/html/guix-devel/2019-05/msg00109.html)
that the guix-daemon.cil file seems to be missing a few items. Without 
this patch
     # restorecon -R /gnu/store
fails.

--- guix-daemon.cil.orig    2020-01-18 07:08:12.905986299 -0800
+++ guix-daemon.cil    2020-01-18 07:09:49.765737261 -0800
@@ -34,14 +34,19 @@
    (roletype object_r guix_daemon_t)
    (type guix_daemon_conf_t)
    (roletype object_r guix_daemon_conf_t)
+  (typeattributeset file_type guix_daemon_conf_t)
    (type guix_daemon_exec_t)
    (roletype object_r guix_daemon_exec_t)
+  (typeattributeset file_type guix_daemon_exec_t)
    (type guix_daemon_socket_t)
    (roletype object_r guix_daemon_socket_t)
+  (typeattributeset file_type guix_daemon_socket_t)
    (type guix_store_content_t)
    (roletype object_r guix_store_content_t)
+  (typeattributeset file_type guix_store_content_t)
    (type guix_profiles_t)
    (roletype object_r guix_profiles_t)
+  (typeattributeset file_type guix_profiles_t)

    ;; These types are domains, thereby allowing process rules
    (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#39172: SElinux guix-daemon.cil file
  2020-01-18 15:40 bug#39172: SElinux guix-daemon.cil file Matt Wette
@ 2020-01-20  9:13 ` Ludovic Courtès
  2020-01-20 10:35   ` Ricardo Wurmus
  0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2020-01-20  9:13 UTC (permalink / raw)
  To: Matt Wette, Ricardo Wurmus; +Cc: 39172

Hi Matt,

Matt Wette <matt.wette@gmail.com> skribis:

> I'm trying to get guix-1.0.1 running on Fedora-30 with its default
> SElinux set up.
> I found (hint from
> https://lists.gnu.org/archive/html/guix-devel/2019-05/msg00109.html)
> that the guix-daemon.cil file seems to be missing a few items. Without
> this patch
>     # restorecon -R /gnu/store
> fails.

OK, thanks for finding it out!

> --- guix-daemon.cil.orig    2020-01-18 07:08:12.905986299 -0800
> +++ guix-daemon.cil    2020-01-18 07:09:49.765737261 -0800
> @@ -34,14 +34,19 @@
>    (roletype object_r guix_daemon_t)
>    (type guix_daemon_conf_t)
>    (roletype object_r guix_daemon_conf_t)
> +  (typeattributeset file_type guix_daemon_conf_t)
>    (type guix_daemon_exec_t)
>    (roletype object_r guix_daemon_exec_t)
> +  (typeattributeset file_type guix_daemon_exec_t)
>    (type guix_daemon_socket_t)
>    (roletype object_r guix_daemon_socket_t)
> +  (typeattributeset file_type guix_daemon_socket_t)
>    (type guix_store_content_t)
>    (roletype object_r guix_store_content_t)
> +  (typeattributeset file_type guix_store_content_t)
>    (type guix_profiles_t)
>    (roletype object_r guix_profiles_t)
> +  (typeattributeset file_type guix_profiles_t)
>
>    ;; These types are domains, thereby allowing process rules
>    (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))

Ricardo, WDYT?  I know nothing about this config file so I’d rather have
your approval before pushing.

Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#39172: SElinux guix-daemon.cil file
  2020-01-20  9:13 ` Ludovic Courtès
@ 2020-01-20 10:35   ` Ricardo Wurmus
  2020-01-27 21:50     ` Ludovic Courtès
  0 siblings, 1 reply; 5+ messages in thread
From: Ricardo Wurmus @ 2020-01-20 10:35 UTC (permalink / raw)
  To: Ludovic Courtès; +Cc: 39172, Matt Wette


Ludovic Courtès <ludo@gnu.org> writes:

> Hi Matt,
>
> Matt Wette <matt.wette@gmail.com> skribis:
>
>> I'm trying to get guix-1.0.1 running on Fedora-30 with its default
>> SElinux set up.
>> I found (hint from
>> https://lists.gnu.org/archive/html/guix-devel/2019-05/msg00109.html)
>> that the guix-daemon.cil file seems to be missing a few items. Without
>> this patch
>>     # restorecon -R /gnu/store
>> fails.
>
> OK, thanks for finding it out!
>
>> --- guix-daemon.cil.orig    2020-01-18 07:08:12.905986299 -0800
>> +++ guix-daemon.cil    2020-01-18 07:09:49.765737261 -0800
>> @@ -34,14 +34,19 @@
>>    (roletype object_r guix_daemon_t)
>>    (type guix_daemon_conf_t)
>>    (roletype object_r guix_daemon_conf_t)
>> +  (typeattributeset file_type guix_daemon_conf_t)
>>    (type guix_daemon_exec_t)
>>    (roletype object_r guix_daemon_exec_t)
>> +  (typeattributeset file_type guix_daemon_exec_t)
>>    (type guix_daemon_socket_t)
>>    (roletype object_r guix_daemon_socket_t)
>> +  (typeattributeset file_type guix_daemon_socket_t)
>>    (type guix_store_content_t)
>>    (roletype object_r guix_store_content_t)
>> +  (typeattributeset file_type guix_store_content_t)
>>    (type guix_profiles_t)
>>    (roletype object_r guix_profiles_t)
>> +  (typeattributeset file_type guix_profiles_t)
>>
>>    ;; These types are domains, thereby allowing process rules
>>    (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))
>
> Ricardo, WDYT?  I know nothing about this config file so I’d rather have
> your approval before pushing.

Could we also do this in one expression?

    (typeattributeset file_type (or guix_profiles_t
                                    guix_daemon_conf_t
                                    guix_daemon_exec_t
                                    guix_daemon_socket_t
                                    guix_store_content_t))

I also think we need to declare our use of “file_type” first:

    (typeattribute file_type)

What do you think?

-- 
Ricardo

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#39172: SElinux guix-daemon.cil file
  2020-01-20 10:35   ` Ricardo Wurmus
@ 2020-01-27 21:50     ` Ludovic Courtès
  2020-01-28 13:45       ` Matt Wette
  0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2020-01-27 21:50 UTC (permalink / raw)
  To: Ricardo Wurmus; +Cc: 39172, Matt Wette

Hello,

Ricardo Wurmus <rekado@elephly.net> skribis:

> Could we also do this in one expression?
>
>     (typeattributeset file_type (or guix_profiles_t
>                                     guix_daemon_conf_t
>                                     guix_daemon_exec_t
>                                     guix_daemon_socket_t
>                                     guix_store_content_t))
>
> I also think we need to declare our use of “file_type” first:
>
>     (typeattribute file_type)
>
> What do you think?

Matt, does what Ricardo proposes work for you?

TIA,
Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#39172: SElinux guix-daemon.cil file
  2020-01-27 21:50     ` Ludovic Courtès
@ 2020-01-28 13:45       ` Matt Wette
  0 siblings, 0 replies; 5+ messages in thread
From: Matt Wette @ 2020-01-28 13:45 UTC (permalink / raw)
  To: Ludovic Courtès, Ricardo Wurmus; +Cc: 39172

On 1/27/20 1:50 PM, Ludovic Courtès wrote:
> Hello,
>
> Ricardo Wurmus <rekado@elephly.net> skribis:
>
>> Could we also do this in one expression?
>>
>>      (typeattributeset file_type (or guix_profiles_t
>>                                      guix_daemon_conf_t
>>                                      guix_daemon_exec_t
>>                                      guix_daemon_socket_t
>>                                      guix_store_content_t))
>>
>> I also think we need to declare our use of “file_type” first:
>>
>>      (typeattribute file_type)
>>
>> What do you think?
> Matt, does what Ricardo proposes work for you?
>

I can add that and see if it helps.  I am just coming up to speed on this.

There are other changes I may be proposing.
Note that use of

     (block guix_daemon
         ... guix_daemon_conf_t
     )

results in the type guix_daemon.guix_daemon_conf_t.   According to

     https://github.com/SELinuxProject/cil/wiki

the convention is something like the following, with added typealias

      (block guix
        ... daemon_conf
      )

     (typealias guix.daemon_conf guix_daemon_conf_t)

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2020-01-28 13:46 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-01-18 15:40 bug#39172: SElinux guix-daemon.cil file Matt Wette
2020-01-20  9:13 ` Ludovic Courtès
2020-01-20 10:35   ` Ricardo Wurmus
2020-01-27 21:50     ` Ludovic Courtès
2020-01-28 13:45       ` Matt Wette

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).