From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id gAiLFKa3rV/KbgAA0tVLHw (envelope-from ) for ; Thu, 12 Nov 2020 22:31:02 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id qDVOEKa3rV83OgAAB5/wlQ (envelope-from ) for ; Thu, 12 Nov 2020 22:31:02 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id C5CA49402DD for ; Thu, 12 Nov 2020 22:31:01 +0000 (UTC) Received: from localhost ([::1]:33012 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kdL7M-0008Cu-Mr for larch@yhetil.org; Thu, 12 Nov 2020 17:31:00 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:40584) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kdKxk-0005mt-1T for guix-patches@gnu.org; Thu, 12 Nov 2020 17:21:04 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:34346) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kdKxi-0007jN-8m for guix-patches@gnu.org; Thu, 12 Nov 2020 17:21:03 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kdKxi-0001NV-5N for guix-patches@gnu.org; Thu, 12 Nov 2020 17:21:02 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#44549] [PATCH] etc: updates for the guix-daemon SELinux policy Resent-From: Marius Bakke Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Thu, 12 Nov 2020 22:21:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 44549 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Daniel Brooks Cc: 44549@debbugs.gnu.org Received: via spool by 44549-submit@debbugs.gnu.org id=B44549.16052196065219 (code B ref 44549); Thu, 12 Nov 2020 22:21:02 +0000 Received: (at 44549) by debbugs.gnu.org; 12 Nov 2020 22:20:06 +0000 Received: from localhost ([127.0.0.1]:45892 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kdKwo-0001M6-9f for submit@debbugs.gnu.org; Thu, 12 Nov 2020 17:20:06 -0500 Received: from eggs.gnu.org ([209.51.188.92]:40288) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kdKwk-0001LS-4n for 44549@debbugs.gnu.org; Thu, 12 Nov 2020 17:20:05 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]:33663) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kdKwd-0007TM-1S; Thu, 12 Nov 2020 17:19:55 -0500 Received: from host-37-191-236-253.lynet.no ([37.191.236.253]:40016 helo=localhost) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kdKwW-0000EW-9v; Thu, 12 Nov 2020 17:19:49 -0500 From: Marius Bakke In-Reply-To: <87v9ea6yhl.fsf@db48x.net> References: <87sg9h8s5j.fsf@db48x.net> <87361ecm7f.fsf@gnu.org> <87v9ea6yhl.fsf@db48x.net> Date: Thu, 12 Nov 2020 23:19:46 +0100 Message-ID: <87tutub4l9.fsf@gnu.org> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-Spam-Score: -3.3 (---) X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+larch=yhetil.org@gnu.org Sender: "Guix-patches" X-Scanner: ns3122888.ip-94-23-21.eu Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of guix-patches-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-patches-bounces@gnu.org X-Spam-Score: -3.61 X-TUID: VZ3nHt1Aq051 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Daniel Brooks writes: >> Daniel Brooks writes: >> >>>>>From 7dd9ed6da01c5bf125c95592f4978b579198731a Mon Sep 17 00:00:00 2001 >>> From: Daniel Brooks >>> Date: Mon, 9 Nov 2020 07:03:42 -0800 >>> Subject: [PATCH] etc: updates for the guix-daemon SELinux policy >>> >>> * etc/guix-daemon.cil.in: I can't promise that this is a complete list = of >>> everything that guix-daemon needs, but it's probably most of them. It c= an >>> search for, install, upgrade, and remove packages, create virtual machi= nes, >>> update itself, and so on. I haven't tried creating containers yet, whic= h might >>> reveal more things to add. >> >> This commit message is somewhat unorthodox. :-) >> >> Perhaps it can be shortened to: >> >> * etc/guix-daemon.cil.in (guix_daemon): Specify more permissions for >> guix-daemon to account for daemon updates and newer SELinux. > > I suppose. Personally I dislike the changelog style commit messages, but > when in Rome=E2=80=A6 It's not a very strong opinion. I think it would be fine without the first person style. >>> +;; In particular, you can run semanage permissive -a guix_daemon.guix_= daemon_t >>> +;; to allow guix-daemon to do whatever it wants. SELinux will still ch= eck its >>> +;; permissions, and when it doesn't have permission it will still send= an >>> +;; audit message to your system logs. This lets you know what permissi= ons it >>> +;; ought to have. Use ausearch --raw to find the permissions violation= s, then >>> +;; pipe that to audit2allow to generate an updated policy. You'll stil= l need >>> +;; to translate that policy into CIL in order to update this file, but= that's >>> +;; fairly straight-forward. Annoying, but easy. >> >> I'm not sure about the second paragraph. It's mainly a rehash of the >> blog post, no? And there are many other ways to go about >> troubleshooting SELinux (I did not use ausearch at all). > > True. I just wanted a quick summary somewhere in the source so that > future us won't have to rely on a random blog post, even one from Dan > Walsh. Fair point. I can imagine a scenario when I'm stuck on a SELinux system without an internet connection. >> diff --git a/etc/guix-daemon.cil.in b/etc/guix-daemon.cil.in >> index 666e5677a3..b5909f1b18 100644 >> --- a/etc/guix-daemon.cil.in >> +++ b/etc/guix-daemon.cil.in >> @@ -84,6 +84,9 @@ >> (allow init_t >> guix_daemon_t >> (process (transition))) >> + (allow init_t >> + guix_store_content_t >> + (lnk_file (read))) > > This one is a little unusual; is your service file symlinked or something? Hmm. Could it be because /etc/systemd/system/guix-daemon.service refers to /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon? >> (allow init_t >> guix_store_content_t >> (file (open read execute))) >> @@ -166,6 +169,9 @@ >> (allow guix_daemon_t >> root_t >> (dir (mounton))) >> + (allow guix_daemon_t >> + guix_daemon_socket_t >> + (sock_file (unlink))) > > That shouldn't be a problem, though we don't have any other rules for > guix_daemon_socket_t. Possibly that is because my socket file is labeled > guix_daemon_conf_t, for unknown reasons. Perhaps it was not labeled > correctly when created, and hasn't been relabeled since. It could also be an artifact from my ancient experiments with Guix and SELinux on this system. Perhaps we should test on a "clean" system to verify, I can do that next week. >> (allow guix_daemon_t >> fs_t >> (filesystem (getattr))) >> @@ -348,7 +354,12 @@ >> getopt setopt))) >> (allow guix_daemon_t >> self >> - (tcp_socket (accept listen bind connect create setopt getopt g= etattr ioctl))) >> + (netlink_route_socket (read write))) >> + (allow guix_daemon_t >> + self >> + (tcp_socket (accept >> + listen bind connect create read write >> + setopt getopt getattr ioctl))) > > These are fine; in fact I discovered these myself this morning and was > going to send a patch. > >> Can you test these additional changes on Fedora? > > Yes, I'll let you know if there are any problems. Also, I'll investigate > the socket file some more. Awesome, thanks a lot! Can you "squash" the relevant changes from my patch and send a new patch when you are done? As a side note, I've seen a couple other audit messages from guix-daemon, although though they don't seem to cause a problem in practice. type=3DAVC msg=3Daudit(1605189801.627:8637388): avc: denied { read } for = pid=3D2312896 comm=3D"guix-daemon" path=3D"socket:[74336318]" dev=3D"sockf= s" ino=3D74336318 scontext=3Dsystem_u:system_r:guix_daemon.guix_daemon_t:s0= tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dunix_stream_socket permiss= ive=3D0 type=3DAVC msg=3Daudit(1605189801.627:8637388): avc: denied { read } for = pid=3D2312896 comm=3D"guix-daemon" path=3D"socket:[74336318]" dev=3D"sockf= s" ino=3D74336318 scontext=3Dsystem_u:system_r:guix_daemon.guix_daemon_t:s0= tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dunix_stream_socket permiss= ive=3D0 type=3DAVC msg=3Daudit(1605189801.627:8637388): avc: denied { siginh } fo= r pid=3D2312896 comm=3D"guix-daemon" scontext=3Dsystem_u:system_r:init_t:s= 0 tcontext=3Dsystem_u:system_r:guix_daemon.guix_daemon_t:s0 tclass=3Dproces= s permissive=3D0 Not sure what that's about. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQFDBAEBCgAtFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAl+ttQIPHG1hcml1c0Bn bnUub3JnAAoJEKKgbfKjOlT6CTIH/2FjjrWerYv+sxeFsEIgJ9f4PCqwqquU4LSl 2ebfNR2VSqKqbYpjLVM1eOY6sRe+pYtbUzoJS9Avw0JESxm9C+LWuOL+yfz4AnK1 /CpcpBr16nn4Wdc0UsF17cv7JKbrgvvc3v9tqQlm3ZBIBmzDJb4DkzCMfX+fiuRu 4wtyimlArOlGacIqmomhcSJ0w6GvS8EgHpsG+8Ee/vcwsI44zp9wMU223E2mdE0d 0hMxe6p28JD1uYa6yZGPh9vJ6l9wyvm31QOlgkfLxao1vf+fbwnTkZdXzyohpc9x AfVwq1/RRQ3T+NtHM+OxuApSB0yKII1wrrdJe9cS1YrvSncRV6Q= =oXtF -----END PGP SIGNATURE----- --=-=-=--