* bug#39172: SElinux guix-daemon.cil file
@ 2020-01-18 15:40 Matt Wette
2020-01-20 9:13 ` Ludovic Courtès
0 siblings, 1 reply; 5+ messages in thread
From: Matt Wette @ 2020-01-18 15:40 UTC (permalink / raw)
To: 39172
Hi All,
I appologize for the formatting. I use tbird and I can't find a way to
do plain-text mode.
I'm trying to get guix-1.0.1 running on Fedora-30 with its default
SElinux set up.
I found (hint from
https://lists.gnu.org/archive/html/guix-devel/2019-05/msg00109.html)
that the guix-daemon.cil file seems to be missing a few items. Without
this patch
# restorecon -R /gnu/store
fails.
--- guix-daemon.cil.orig 2020-01-18 07:08:12.905986299 -0800
+++ guix-daemon.cil 2020-01-18 07:09:49.765737261 -0800
@@ -34,14 +34,19 @@
(roletype object_r guix_daemon_t)
(type guix_daemon_conf_t)
(roletype object_r guix_daemon_conf_t)
+ (typeattributeset file_type guix_daemon_conf_t)
(type guix_daemon_exec_t)
(roletype object_r guix_daemon_exec_t)
+ (typeattributeset file_type guix_daemon_exec_t)
(type guix_daemon_socket_t)
(roletype object_r guix_daemon_socket_t)
+ (typeattributeset file_type guix_daemon_socket_t)
(type guix_store_content_t)
(roletype object_r guix_store_content_t)
+ (typeattributeset file_type guix_store_content_t)
(type guix_profiles_t)
(roletype object_r guix_profiles_t)
+ (typeattributeset file_type guix_profiles_t)
;; These types are domains, thereby allowing process rules
(typeattributeset domain (guix_daemon_t guix_daemon_exec_t))
^ permalink raw reply [flat|nested] 5+ messages in thread
* bug#39172: SElinux guix-daemon.cil file
2020-01-18 15:40 bug#39172: SElinux guix-daemon.cil file Matt Wette
@ 2020-01-20 9:13 ` Ludovic Courtès
2020-01-20 10:35 ` Ricardo Wurmus
0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2020-01-20 9:13 UTC (permalink / raw)
To: Matt Wette, Ricardo Wurmus; +Cc: 39172
Hi Matt,
Matt Wette <matt.wette@gmail.com> skribis:
> I'm trying to get guix-1.0.1 running on Fedora-30 with its default
> SElinux set up.
> I found (hint from
> https://lists.gnu.org/archive/html/guix-devel/2019-05/msg00109.html)
> that the guix-daemon.cil file seems to be missing a few items. Without
> this patch
> # restorecon -R /gnu/store
> fails.
OK, thanks for finding it out!
> --- guix-daemon.cil.orig 2020-01-18 07:08:12.905986299 -0800
> +++ guix-daemon.cil 2020-01-18 07:09:49.765737261 -0800
> @@ -34,14 +34,19 @@
> (roletype object_r guix_daemon_t)
> (type guix_daemon_conf_t)
> (roletype object_r guix_daemon_conf_t)
> + (typeattributeset file_type guix_daemon_conf_t)
> (type guix_daemon_exec_t)
> (roletype object_r guix_daemon_exec_t)
> + (typeattributeset file_type guix_daemon_exec_t)
> (type guix_daemon_socket_t)
> (roletype object_r guix_daemon_socket_t)
> + (typeattributeset file_type guix_daemon_socket_t)
> (type guix_store_content_t)
> (roletype object_r guix_store_content_t)
> + (typeattributeset file_type guix_store_content_t)
> (type guix_profiles_t)
> (roletype object_r guix_profiles_t)
> + (typeattributeset file_type guix_profiles_t)
>
> ;; These types are domains, thereby allowing process rules
> (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))
Ricardo, WDYT? I know nothing about this config file so I’d rather have
your approval before pushing.
Ludo’.
^ permalink raw reply [flat|nested] 5+ messages in thread
* bug#39172: SElinux guix-daemon.cil file
2020-01-20 9:13 ` Ludovic Courtès
@ 2020-01-20 10:35 ` Ricardo Wurmus
2020-01-27 21:50 ` Ludovic Courtès
0 siblings, 1 reply; 5+ messages in thread
From: Ricardo Wurmus @ 2020-01-20 10:35 UTC (permalink / raw)
To: Ludovic Courtès; +Cc: 39172, Matt Wette
Ludovic Courtès <ludo@gnu.org> writes:
> Hi Matt,
>
> Matt Wette <matt.wette@gmail.com> skribis:
>
>> I'm trying to get guix-1.0.1 running on Fedora-30 with its default
>> SElinux set up.
>> I found (hint from
>> https://lists.gnu.org/archive/html/guix-devel/2019-05/msg00109.html)
>> that the guix-daemon.cil file seems to be missing a few items. Without
>> this patch
>> # restorecon -R /gnu/store
>> fails.
>
> OK, thanks for finding it out!
>
>> --- guix-daemon.cil.orig 2020-01-18 07:08:12.905986299 -0800
>> +++ guix-daemon.cil 2020-01-18 07:09:49.765737261 -0800
>> @@ -34,14 +34,19 @@
>> (roletype object_r guix_daemon_t)
>> (type guix_daemon_conf_t)
>> (roletype object_r guix_daemon_conf_t)
>> + (typeattributeset file_type guix_daemon_conf_t)
>> (type guix_daemon_exec_t)
>> (roletype object_r guix_daemon_exec_t)
>> + (typeattributeset file_type guix_daemon_exec_t)
>> (type guix_daemon_socket_t)
>> (roletype object_r guix_daemon_socket_t)
>> + (typeattributeset file_type guix_daemon_socket_t)
>> (type guix_store_content_t)
>> (roletype object_r guix_store_content_t)
>> + (typeattributeset file_type guix_store_content_t)
>> (type guix_profiles_t)
>> (roletype object_r guix_profiles_t)
>> + (typeattributeset file_type guix_profiles_t)
>>
>> ;; These types are domains, thereby allowing process rules
>> (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))
>
> Ricardo, WDYT? I know nothing about this config file so I’d rather have
> your approval before pushing.
Could we also do this in one expression?
(typeattributeset file_type (or guix_profiles_t
guix_daemon_conf_t
guix_daemon_exec_t
guix_daemon_socket_t
guix_store_content_t))
I also think we need to declare our use of “file_type” first:
(typeattribute file_type)
What do you think?
--
Ricardo
^ permalink raw reply [flat|nested] 5+ messages in thread* bug#39172: SElinux guix-daemon.cil file
2020-01-20 10:35 ` Ricardo Wurmus
@ 2020-01-27 21:50 ` Ludovic Courtès
2020-01-28 13:45 ` Matt Wette
0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2020-01-27 21:50 UTC (permalink / raw)
To: Ricardo Wurmus; +Cc: 39172, Matt Wette
Hello,
Ricardo Wurmus <rekado@elephly.net> skribis:
> Could we also do this in one expression?
>
> (typeattributeset file_type (or guix_profiles_t
> guix_daemon_conf_t
> guix_daemon_exec_t
> guix_daemon_socket_t
> guix_store_content_t))
>
> I also think we need to declare our use of “file_type” first:
>
> (typeattribute file_type)
>
> What do you think?
Matt, does what Ricardo proposes work for you?
TIA,
Ludo’.
^ permalink raw reply [flat|nested] 5+ messages in thread
* bug#39172: SElinux guix-daemon.cil file
2020-01-27 21:50 ` Ludovic Courtès
@ 2020-01-28 13:45 ` Matt Wette
0 siblings, 0 replies; 5+ messages in thread
From: Matt Wette @ 2020-01-28 13:45 UTC (permalink / raw)
To: Ludovic Courtès, Ricardo Wurmus; +Cc: 39172
On 1/27/20 1:50 PM, Ludovic Courtès wrote:
> Hello,
>
> Ricardo Wurmus <rekado@elephly.net> skribis:
>
>> Could we also do this in one expression?
>>
>> (typeattributeset file_type (or guix_profiles_t
>> guix_daemon_conf_t
>> guix_daemon_exec_t
>> guix_daemon_socket_t
>> guix_store_content_t))
>>
>> I also think we need to declare our use of “file_type” first:
>>
>> (typeattribute file_type)
>>
>> What do you think?
> Matt, does what Ricardo proposes work for you?
>
I can add that and see if it helps. I am just coming up to speed on this.
There are other changes I may be proposing.
Note that use of
(block guix_daemon
... guix_daemon_conf_t
)
results in the type guix_daemon.guix_daemon_conf_t. According to
https://github.com/SELinuxProject/cil/wiki
the convention is something like the following, with added typealias
(block guix
... daemon_conf
)
(typealias guix.daemon_conf guix_daemon_conf_t)
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-01-28 13:46 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-01-18 15:40 bug#39172: SElinux guix-daemon.cil file Matt Wette
2020-01-20 9:13 ` Ludovic Courtès
2020-01-20 10:35 ` Ricardo Wurmus
2020-01-27 21:50 ` Ludovic Courtès
2020-01-28 13:45 ` Matt Wette
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).