Re: [PATCH] Add SELinux policy for guix-daemon.

[Alex Vong <alexvong1995@gmail.com>]

Gábor Boskovits <boskovits@gmail.com> writes:

> 2018-02-15 16:32 GMT+01:00 Ricardo Wurmus <rekado@elephly.net>:
>
>  Alex Vong <alexvong1995@gmail.com> writes:
>
>  >> No, the script won’t install the SELinux policy. It wouldn’t work on
>  >> all systems, only on those where a suitable SELinux base policy is
>  >> available.
>  >>
>  > So it won't work on Debian? I think Debian and Fedora uses different
>  > base policy, right?
>
>  I don’t know much about SELinux on Debian, I’m afraid.
>
>  > If this is the case, should we also include an
>  > apparmor profile?
>
>  That’s unrelated, but sure, why not.
>
>  I would suggest writing a minimal base policy. SELinux is not an
>  all-or-nothing affair. That base policy only needs to provide the few
>  types that we care about for the guix-daemon. It wouldn’t be too hard.
>
>  The resulting policy could then be used on GuixSD or any other system
>  that doesn’t have a full SELinux configuration.
>
> I would be interested in doing that. It would be great if we could use
> SELinux on GuixSD. I also like the apparmor idea. These would be
> great enablers for me. Do we have any policy how we do these, or
> should I check how it is done on other distros?
>
Since I haven't learnt selinux, I will only comment on apparmor (which I
learnt only recently). For apparmor, there is a documentation page[0]
and guide to write profiles[1]. In general, there are two approach -
generate profile or write profile by hand. In any case, it looks hard to
me since we will have to test everything guix-daemon can do to make sure
it really works. Maybe it will help if you know guix-daemon really well,
or you understand the SELinux profile...

[0]: https://gitlab.com/apparmor/apparmor/wikis/Documentation
[1]: https://gitlab.com/apparmor/apparmor/wikis/Profiles

>  > Which paths does guix-daemon need to have r/w access
>  > to? From your SELinux profile, we know the following is needed:
>  >
>  > @guix_sysconfdir@/guix(/.*)?
>  > @guix_localstatedir@/guix(/.*)?
>  > @guix_localstatedir@/guix/profiles(/.*)?
>  > /gnu
>  > @storedir@(/.+)?
>  > @storedir@/[^/]+/.+
>  > @prefix@/bin/guix-daemon
>  > @storedir@/.+-(guix-.+|profile)/bin/guix-daemon
>  > @storedir@/.+-(guix-.+|profile)/libexec/guix-authenticate
>  > @storedir@/.+-(guix-.+|profile)/libexec/guix/(.*)?
>  > @guix_localstatedir@/guix/daemon-socket/socket
>
>  These are not things that the daemon needs to have access to. These are
>  paths that are to be labeled. The daemon is executed in a certain
>  context, and processes in that context may have certain permissions on
>  some of the files that have been labeled.
>
>  --
>  Ricardo
>
>  GPG: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC
>  https://elephly.net