From mboxrd@z Thu Jan 1 00:00:00 1970 From: Laura Lazzati Subject: Re: SELinux log Date: Thu, 6 Jun 2019 22:46:28 -0300 Message-ID: References: <87sgsocqx5.fsf@elephly.net> <87k1dyk33n.fsf@elephly.net> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:38748) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hZ3yG-0000GM-SP for guix-devel@gnu.org; Thu, 06 Jun 2019 21:47:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hZ3yF-0007GS-Le for guix-devel@gnu.org; Thu, 06 Jun 2019 21:47:08 -0400 Received: from mail-wr1-x432.google.com ([2a00:1450:4864:20::432]:38682) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hZ3yF-0007Bg-B6 for guix-devel@gnu.org; Thu, 06 Jun 2019 21:47:07 -0400 Received: by mail-wr1-x432.google.com with SMTP id d18so487115wrs.5 for ; Thu, 06 Jun 2019 18:47:07 -0700 (PDT) In-Reply-To: <87k1dyk33n.fsf@elephly.net> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ricardo Wurmus Cc: Guix-devel Hi! Hope to shed some light. I followed all the steps that I hadn't followed before in the documentation manual about SELinux for guix daemon (ran semodule, restorecon for all the filesystem and restarted the daemon). I forgot to set SELinux in permissive mode, so I still got the issue with the socket. Then I realized about this, and changed the mode. My log shows that SELinux would have prevented the daemon from running, like when I had it in enforcing mode: -----------------------------------------------start here------------------------------------------------------- type=SERVICE_START msg=audit(1559870054.070:258): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=flatpak-system-helper comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset" type=SERVICE_STOP msg=audit(1559870056.300:259): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=user@42 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset" type=SERVICE_STOP msg=audit(1559870056.340:260): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=user-runtime-dir@42 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset" type=AVC msg=audit(1559870056.930:261): avc: denied { read } for pid=750 comm="guix-daemon" name="libnss_files.so.2" dev="dm-0" ino=559459 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=lnk_file permissive=1 type=AVC msg=audit(1559870056.930:262): avc: denied { map } for pid=750 comm="guix-daemon" path="/gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/libnss_files-2.28.so" dev="dm-0" ino=559457 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870056.930:263): avc: denied { execute } for pid=750 comm="guix-daemon" path="/gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/libnss_files-2.28.so" dev="dm-0" ino=559457 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870056.937:264): avc: denied { create } for pid=2170 comm="guix-daemon" name="reserved" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870056.937:265): avc: denied { write } for pid=2170 comm="guix-daemon" path="/var/guix/db/reserved" dev="dm-0" ino=306296 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870056.940:266): avc: denied { write } for pid=2170 comm="guix-daemon" name="db.sqlite" dev="dm-0" ino=306225 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870056.950:267): avc: denied { setattr } for pid=2170 comm="guix-daemon" name="db.sqlite-wal" dev="dm-0" ino=306376 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870056.950:268): avc: denied { map } for pid=2170 comm="guix-daemon" path="/var/guix/db/db.sqlite-shm" dev="dm-0" ino=306377 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870058.000:269): avc: denied { link } for pid=2170 comm="guix-daemon" name="7f1alh9qj2h0wwy2220npgnmw6pbrkwx-mirrors" dev="dm-0" ino=551918 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870058.130:270): avc: denied { rename } for pid=2170 comm="guix-daemon" name=".tmp-link-2170-1804289383" dev="dm-0" ino=551930 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870060.410:271): avc: denied { execute_no_trans } for pid=2173 comm="guix-daemon" path="/gnu/store/ncknl03pkmamrxg7q9nxi1rn1qhvwbi9-guix-1.0.1/libexec/guix/substitute" dev="dm-0" ino=679069 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=1 type=AVC msg=audit(1559870060.886:272): avc: denied { name_connect } for pid=2173 comm=677569782073756273746974757465 dest=443 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=1 type=SERVICE_STOP msg=audit(1559870062.620:273): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset" type=SERVICE_STOP msg=audit(1559870070.140:274): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-localed comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset" -----------------------------------------------end here------------------------------------------------------- Regards! Laura