From: Alexis Simon via Bug reports for GNU Guix <bug-guix@gnu.org>
To: 66305@debbugs.gnu.org
Subject: bug#66305: Error with recursive git checkout
Date: Wed, 25 Oct 2023 09:51:37 -0700 [thread overview]
Message-ID: <ee85ee58-c432-4724-8c0b-c43b6fd6e810@runbox.com> (raw)
In-Reply-To: <87msx1qmvs.fsf@kitej>
ah well it seems this is due to a selinux policy error
--8<---------------cut here---------------start------------->8---
SELinux is preventing git-submodule from execute access on the file
/usr/bin/sed.
***** Plugin catchall (100. confidence) suggests
**************************
If you believe that git-submodule should be allowed execute access on
the sed file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'git-submodule' --raw | audit2allow -M my-gitsubmodule
# semodule -X 300 -i my-gitsubmodule.pp
Additional Information:
Source Context system_u:system_r:guix_daemon.guix_daemon_t:s0
Target Context system_u:object_r:bin_t:s0
Target Objects /usr/bin/sed [ file ]
Source git-submodule
Source Path git-submodule
Port <Unknown>
Host xps13
Source RPM Packages
Target RPM Packages sed-4.8-12.fc38.x86_64
SELinux Policy RPM selinux-policy-targeted-38.29-1.fc38.noarch
Local Policy RPM
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name xps13
Platform Linux xps13 6.5.7-200.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Wed Oct 11 04:07:58 UTC 2023
x86_64
Alert Count 460
First Seen 2023-10-24 20:20:26 PDT
Last Seen 2023-10-25 09:44:31 PDT
Local ID fa57086c-6738-4eec-8252-3abb66a9e249
Raw Audit Messages
type=AVC msg=audit(1698252271.150:513): avc: denied { execute } for
pid=10644 comm="git-submodule" name="sed" dev="dm-0" ino=261979
scontext=system_u:system_r:guix_daemon.guix_daemon_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0
Hash: git-submodule,guix_daemon.guix_daemon_t,bin_t,file,execute
--8<---------------cut here---------------end--------------->8---
But trying to fix it does not seem to have any effect. I've added this
to the guix-daemon.cil and re-applied
--8<---------------cut here---------------start------------->8---
(allow guix_daemon_t
bin_t
(file (execute)))
--8<---------------cut here---------------end--------------->8---
Alexis
next prev parent reply other threads:[~2023-10-26 22:08 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-02 11:17 bug#66305: Error with recursive git checkout Guillaume Le Vaillant
2023-10-02 17:37 ` Guillaume Le Vaillant
2023-10-03 19:26 ` Simon Tournier
2023-10-04 16:25 ` Ludovic Courtès
2023-10-04 18:16 ` Simon Tournier
2023-10-04 18:18 ` Simon Tournier
2023-10-05 9:28 ` Ludovic Courtès
2023-10-05 21:31 ` Ludovic Courtès
2023-10-12 14:42 ` Ludovic Courtès
2023-10-25 4:53 ` Alexis Simon via Bug reports for GNU Guix
2023-10-25 16:51 ` Alexis Simon via Bug reports for GNU Guix [this message]
2023-10-25 17:47 ` Alexis Simon via Bug reports for GNU Guix
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ee85ee58-c432-4724-8c0b-c43b6fd6e810@runbox.com \
--to=bug-guix@gnu.org \
--cc=66305@debbugs.gnu.org \
--cc=alexis.simon@runbox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).