unofficial mirror of help-guix@gnu.org 
 help / color / mirror / Atom feed
From: Alexis Simon <alexis.simon@runbox.com>
To: help-guix@gnu.org
Subject: Stuck installing guix package manager on Fedora with selinux
Date: Tue, 17 Oct 2023 09:42:58 -0700	[thread overview]
Message-ID: <2f749c20-ede2-4f1c-b95a-e9bfc1869fad@runbox.com> (raw)

Hi,

I'd like to try the guix package manager but am stuck installing it on 
Fedora 38 with selinux. I should say I don't know anything about the 
details of either guix or selinux.
I know a few other persons that also wanted to try guix but gave up due 
to issues with selinux, so I think solving this issue could help in 
adoption.

I've used the installer script which worked well, then was initially hit 
by this error
`guix install: error: remounting /gnu/store writable: Permission denied`

This was solved by doing
sudo semodule -i 
/gnu/store/5kj8lyybjrdl7xd0fx9g9vzkz8sklqsy-guix-1.4.0/share/selinux/guix-daemon.cil 

sudo mount -o remount,rw /gnu/store
sudo restorecon -R /gnu /var/guix
sudo systemctl restart guix-daemon.service

(note that the mount step was the missing part that was missing from all 
guides I've seen on the web, and I found it in a guix commit).

Now I have a different issue, guix-daemon doesn't seem to be able to 
access internet with errors of the type
`In procedure getaddrinfo: Temporary failure in name resolution`
(disabling selinux works in that case, but I want it enabled)

This is what I get from setroubleshoot:
```
SELinux is preventing guix substitute from search access on the 
directory systemd.
*****  Plugin catchall (100. confidence) suggests   *****
*********************
If you believe that guix substitute should be allowed sea
rch access on the systemd directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this acce
ss.
Do
allow this access for now by executing:
# ausearch -c 'guix substitute' --raw | audit2allow -M my
-guixsubstitute
# semodule -X 300 -i my-guixsubstitute.pp
```

Trying the suggested commands also errors in:
```
libsepol.hierarchy_add_type_callback: guix_daemon doesn't exist, 
guix_daemon.guix_daemon_t is an orphan
libsepol.hierarchy_add_bounds: 1 errors found while adding hierarchies
```

So I don't really know where to go from there, any help appreciated.
Thanks
Alexis


             reply	other threads:[~2023-10-18  4:33 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-10-17 16:42 Alexis Simon [this message]
2023-10-18 13:40 ` Stuck installing guix package manager on Fedora with selinux Markku Korkeala
2023-10-18 17:06   ` Alexis Simon
2023-10-18 18:16     ` Alexis Simon
2023-10-19  2:02       ` Maxim Cournoyer
2023-10-19  3:22         ` Alexis Simon
2023-10-19  3:36           ` Maxim Cournoyer
2023-10-20 11:32     ` Markku Korkeala

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2f749c20-ede2-4f1c-b95a-e9bfc1869fad@runbox.com \
    --to=alexis.simon@runbox.com \
    --cc=help-guix@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).