From: Alexis Simon <alexis.simon@runbox.com>
To: help-guix@gnu.org
Subject: Stuck installing guix package manager on Fedora with selinux
Date: Tue, 17 Oct 2023 09:42:58 -0700 [thread overview]
Message-ID: <2f749c20-ede2-4f1c-b95a-e9bfc1869fad@runbox.com> (raw)
Hi,
I'd like to try the guix package manager but am stuck installing it on
Fedora 38 with selinux. I should say I don't know anything about the
details of either guix or selinux.
I know a few other persons that also wanted to try guix but gave up due
to issues with selinux, so I think solving this issue could help in
adoption.
I've used the installer script which worked well, then was initially hit
by this error
`guix install: error: remounting /gnu/store writable: Permission denied`
This was solved by doing
sudo semodule -i
/gnu/store/5kj8lyybjrdl7xd0fx9g9vzkz8sklqsy-guix-1.4.0/share/selinux/guix-daemon.cil
sudo mount -o remount,rw /gnu/store
sudo restorecon -R /gnu /var/guix
sudo systemctl restart guix-daemon.service
(note that the mount step was the missing part that was missing from all
guides I've seen on the web, and I found it in a guix commit).
Now I have a different issue, guix-daemon doesn't seem to be able to
access internet with errors of the type
`In procedure getaddrinfo: Temporary failure in name resolution`
(disabling selinux works in that case, but I want it enabled)
This is what I get from setroubleshoot:
```
SELinux is preventing guix substitute from search access on the
directory systemd.
***** Plugin catchall (100. confidence) suggests *****
*********************
If you believe that guix substitute should be allowed sea
rch access on the systemd directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this acce
ss.
Do
allow this access for now by executing:
# ausearch -c 'guix substitute' --raw | audit2allow -M my
-guixsubstitute
# semodule -X 300 -i my-guixsubstitute.pp
```
Trying the suggested commands also errors in:
```
libsepol.hierarchy_add_type_callback: guix_daemon doesn't exist,
guix_daemon.guix_daemon_t is an orphan
libsepol.hierarchy_add_bounds: 1 errors found while adding hierarchies
```
So I don't really know where to go from there, any help appreciated.
Thanks
Alexis
next reply other threads:[~2023-10-18 4:33 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-17 16:42 Alexis Simon [this message]
2023-10-18 13:40 ` Stuck installing guix package manager on Fedora with selinux Markku Korkeala
2023-10-18 17:06 ` Alexis Simon
2023-10-18 18:16 ` Alexis Simon
2023-10-19 2:02 ` Maxim Cournoyer
2023-10-19 3:22 ` Alexis Simon
2023-10-19 3:36 ` Maxim Cournoyer
2023-10-20 11:32 ` Markku Korkeala
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2f749c20-ede2-4f1c-b95a-e9bfc1869fad@runbox.com \
--to=alexis.simon@runbox.com \
--cc=help-guix@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).