From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id 1B89HZevrV+ZNAAA0tVLHw (envelope-from ) for ; Thu, 12 Nov 2020 21:56:39 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id IBycGJevrV8ZEgAAbx9fmQ (envelope-from ) for ; Thu, 12 Nov 2020 21:56:39 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 5808494051B for ; Thu, 12 Nov 2020 21:56:38 +0000 (UTC) Received: from localhost ([::1]:59874 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kdKa4-0003rj-Iz for larch@yhetil.org; Thu, 12 Nov 2020 16:56:36 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:33416) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kdKPp-0006n4-TH for guix-patches@gnu.org; Thu, 12 Nov 2020 16:46:06 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:34279) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kdKPp-0003Zi-Ju for guix-patches@gnu.org; Thu, 12 Nov 2020 16:46:01 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kdKPp-0000WE-IX for guix-patches@gnu.org; Thu, 12 Nov 2020 16:46:01 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#44549] [PATCH] etc: updates for the guix-daemon SELinux policy Resent-From: Daniel Brooks Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Thu, 12 Nov 2020 21:46:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 44549 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Marius Bakke Cc: 44549@debbugs.gnu.org Received: via spool by 44549-submit@debbugs.gnu.org id=B44549.16052175191944 (code B ref 44549); Thu, 12 Nov 2020 21:46:01 +0000 Received: (at 44549) by debbugs.gnu.org; 12 Nov 2020 21:45:19 +0000 Received: from localhost ([127.0.0.1]:45825 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kdKP9-0000VF-Af for submit@debbugs.gnu.org; Thu, 12 Nov 2020 16:45:19 -0500 Received: from smtp-out-4.mxes.net ([198.205.123.69]:42430) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kdKP7-0000V0-B6 for 44549@debbugs.gnu.org; Thu, 12 Nov 2020 16:45:18 -0500 Received: from Customer-MUA (mua.mxes.net [10.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.mxes.net (Postfix) with ESMTPSA id 625C475A8D; Thu, 12 Nov 2020 16:45:11 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mxes.net; s=mta; t=1605217511; bh=Jz5nDoDo/6jHTzNjsUwI5ZP/QqPD7Tu1o+vlrxJocUA=; h=From:To:Subject:References:Date:In-Reply-To:Message-ID: MIME-Version:Content-Type; b=JL8eaWy8XGx2i4Nz7PSTyrnunjgzvOghUUZjq36E13qyISG12kCyr+5Is2tOLHKzb fAGkaYWVAu8kiSJTFaQe21naytdAF+LAi7MEbXQlGqwVh9rbyZKbAURiEeWaSmuZG2 wCpLGtiV1NGW6atd38e3BpouoGN8xRY2EbOSyBLU= From: Daniel Brooks References: <87sg9h8s5j.fsf@db48x.net> <87361ecm7f.fsf@gnu.org> Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAABGdBTUEAALGOfPtRkwAAABJQ TFRFpKfbdou67PD6JjJgAwUWXGSeIcyLHgAAAkZJREFUOI1VU8Fy6yAMxLi+Q13fCZ3cnQL3dqTc 7RD+/1feStDXVnXHDuvVSivZTMba2GPdw3gyCGcMAFxTyrTd9dwGoxHiZX9PmRFUHYAQlGGtXY+F Uk0SJOxgJiUEnH1qkitT9D+pQub7qGAmUbR6bu3CvI96Yv6QqkBBMrsyfZccr1/RDXGDTLf4P7ZY glVxe2V+/ACXWO1gvDO9/gDRpFFVmPluvLcmBjd5H6d8DEte+Pbk4rcY/Fa5tLKLOtCZsuQKYhpa LOkYDT7hESya7/WIET3lfQBqX0pwFtbI832Is0ayMUR9B+12xjgPCQ089cfwkCkX6L5TPmRelJTh zMS0Sz1PyjLAMCUWjcmgQLWQMds+e3aaauZDf9dU9A2/8kPVF2odCUoMKHkfjJR+mbgC+DRiycw5 3XSqGe6HmhN/AWjHypkAXOAFW5EiuA1ge2GiZuMb0s1fSEXcATeLUfbyEY2L8yPOmdSsdghQXx3K pz2eoeXuYvMCINVFDrCdNfVUp4eJ6cSEbjbgFjBEvonGGTrgv9cHjAc8aVgSAPoxaONbzfwhDIhR at7IIS7fAGiDSwIA9alhhTBzfA7YM2FY6eMwayrIGK8FDFmshmUA43WqhFtpvoqG9HHaJ7fqtgTz 8EWVkgZgtsylFliHDgk0MB7KAEC45C/rgnGvanNLXyzOeTzcT2nw/N44gfrtYXRQLoz9Q3TgmJRx 2Mx/Q51qzpm+l3m8z2SWBqC5+PZXAtNYlGFf/gKfHfjFkDT4x7od7R+w3Ls+ZdQBuQAAAABJRU5E rkJggg== Date: Thu, 12 Nov 2020 13:45:10 -0800 In-Reply-To: <87361ecm7f.fsf@gnu.org> (Marius Bakke's message of "Thu, 12 Nov 2020 22:13:56 +0100") Message-ID: <87v9ea6yhl.fsf@db48x.net> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Sent-To: X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-Spam-Score: -1.7 (-) X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+larch=yhetil.org@gnu.org Sender: "Guix-patches" X-Scanner: ns3122888.ip-94-23-21.eu Authentication-Results: aspmx1.migadu.com; dkim=fail (headers rsa verify failed) header.d=mxes.net header.s=mta header.b=JL8eaWy8; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-patches-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-patches-bounces@gnu.org X-Spam-Score: -0.01 X-TUID: D5nynuse25MD Marius Bakke writes: > Hello Daniel, > > Thanks a lot for this. You're welcome. > > Daniel Brooks writes: > >>>>From 7dd9ed6da01c5bf125c95592f4978b579198731a Mon Sep 17 00:00:00 2001 >> From: Daniel Brooks >> Date: Mon, 9 Nov 2020 07:03:42 -0800 >> Subject: [PATCH] etc: updates for the guix-daemon SELinux policy >> >> * etc/guix-daemon.cil.in: I can't promise that this is a complete list of >> everything that guix-daemon needs, but it's probably most of them. It can >> search for, install, upgrade, and remove packages, create virtual machin= es, >> update itself, and so on. I haven't tried creating containers yet, which= might >> reveal more things to add. > > This commit message is somewhat unorthodox. :-) > > Perhaps it can be shortened to: > > * etc/guix-daemon.cil.in (guix_daemon): Specify more permissions for > guix-daemon to account for daemon updates and newer SELinux. I suppose. Personally I dislike the changelog style commit messages, but when in Rome=E2=80=A6 >> +;; In particular, you can run semanage permissive -a guix_daemon.guix_d= aemon_t >> +;; to allow guix-daemon to do whatever it wants. SELinux will still che= ck its >> +;; permissions, and when it doesn't have permission it will still send = an >> +;; audit message to your system logs. This lets you know what permissio= ns it >> +;; ought to have. Use ausearch --raw to find the permissions violations= , then >> +;; pipe that to audit2allow to generate an updated policy. You'll still= need >> +;; to translate that policy into CIL in order to update this file, but = that's >> +;; fairly straight-forward. Annoying, but easy. > > I'm not sure about the second paragraph. It's mainly a rehash of the > blog post, no? And there are many other ways to go about > troubleshooting SELinux (I did not use ausearch at all). True. I just wanted a quick summary somewhere in the source so that future us won't have to rely on a random blog post, even one from Dan Walsh. > diff --git a/etc/guix-daemon.cil.in b/etc/guix-daemon.cil.in > index 666e5677a3..b5909f1b18 100644 > --- a/etc/guix-daemon.cil.in > +++ b/etc/guix-daemon.cil.in > @@ -84,6 +84,9 @@ > (allow init_t > guix_daemon_t > (process (transition))) > + (allow init_t > + guix_store_content_t > + (lnk_file (read))) This one is a little unusual; is your service file symlinked or something? > (allow init_t > guix_store_content_t > (file (open read execute))) > @@ -166,6 +169,9 @@ > (allow guix_daemon_t > root_t > (dir (mounton))) > + (allow guix_daemon_t > + guix_daemon_socket_t > + (sock_file (unlink))) That shouldn't be a problem, though we don't have any other rules for guix_daemon_socket_t. Possibly that is because my socket file is labeled guix_daemon_conf_t, for unknown reasons. Perhaps it was not labeled correctly when created, and hasn't been relabeled since. > (allow guix_daemon_t > fs_t > (filesystem (getattr))) > @@ -348,7 +354,12 @@ > getopt setopt))) > (allow guix_daemon_t > self > - (tcp_socket (accept listen bind connect create setopt getopt ge= tattr ioctl))) > + (netlink_route_socket (read write))) > + (allow guix_daemon_t > + self > + (tcp_socket (accept > + listen bind connect create read write > + setopt getopt getattr ioctl))) These are fine; in fact I discovered these myself this morning and was going to send a patch. > Can you test these additional changes on Fedora? Yes, I'll let you know if there are any problems. Also, I'll investigate the socket file some more. > > With this, I no longer have to go through 'guix pack' and 'podman' to > run Guix packages on my RHEL workstation! :-) Ideal :) > > Also, is it OK to add you to the list of contributors at the top of the > file with this name and address? Certainly. db48x