Re: Stuck installing guix package manager on Fedora with selinux

[Alexis Simon <alexis.simon@runbox.com>]

Hi, Thanks for the suggestion.

I stumbled on this guix rpm but it seems also that selinux needs to be 
disabled with that one.
I think the maintainer initially wanted to apply selinux policies but in 
the end commented out all those parts. (There's also a hint in the 
changelog that it doesn't work with selinux, see here [0]).

As someone else suggested, yes I could set selinux to permissive but I 
don't find that an acceptable solution. I don't want to disable a 
security feature of my system.

Also an update on my initial email: after a reboot, I'm back at square 
one with the remount error. So the solution wasn't really one.

Best regards,
Alexis

[0] 
https://copr-dist-git.fedorainfracloud.org/cgit/lantw44/guix/guix.git/tree/guix.spec?h=f38#n556

On 18/10/2023 06:40, Markku Korkeala wrote:
> Hi,
> 
> I haven't tried the official guix installation, but I was
> able to get guix running on Fedora using rpm packages from copr:
> 
> https://copr.fedorainfracloud.org/coprs/lantw44/guix/
> 
> If you can't find solution to the SELinux problem, maybe
> give those rpm packages a try.
> 
> Best regards,
> Markku
> 
> On Tue, Oct 17, 2023 at 09:42:58AM -0700, Alexis Simon wrote:
>> Hi,
>>
>> I'd like to try the guix package manager but am stuck installing it on
>> Fedora 38 with selinux. I should say I don't know anything about the details
>> of either guix or selinux.
>> I know a few other persons that also wanted to try guix but gave up due to
>> issues with selinux, so I think solving this issue could help in adoption.
>>
>> I've used the installer script which worked well, then was initially hit by
>> this error
>> `guix install: error: remounting /gnu/store writable: Permission denied`
>>
>> This was solved by doing
>> sudo semodule -i /gnu/store/5kj8lyybjrdl7xd0fx9g9vzkz8sklqsy-guix-1.4.0/share/selinux/guix-daemon.cil
>>
>> sudo mount -o remount,rw /gnu/store
>> sudo restorecon -R /gnu /var/guix
>> sudo systemctl restart guix-daemon.service
>>
>> (note that the mount step was the missing part that was missing from all
>> guides I've seen on the web, and I found it in a guix commit).
>>
>> Now I have a different issue, guix-daemon doesn't seem to be able to access
>> internet with errors of the type
>> `In procedure getaddrinfo: Temporary failure in name resolution`
>> (disabling selinux works in that case, but I want it enabled)
>>
>> This is what I get from setroubleshoot:
>> ```
>> SELinux is preventing guix substitute from search access on the directory
>> systemd.
>> *****  Plugin catchall (100. confidence) suggests   *****
>> *********************
>> If you believe that guix substitute should be allowed sea
>> rch access on the systemd directory by default.
>> Then you should report this as a bug.
>> You can generate a local policy module to allow this acce
>> ss.
>> Do
>> allow this access for now by executing:
>> # ausearch -c 'guix substitute' --raw | audit2allow -M my
>> -guixsubstitute
>> # semodule -X 300 -i my-guixsubstitute.pp
>> ```
>>
>> Trying the suggested commands also errors in:
>> ```
>> libsepol.hierarchy_add_type_callback: guix_daemon doesn't exist,
>> guix_daemon.guix_daemon_t is an orphan
>> libsepol.hierarchy_add_bounds: 1 errors found while adding hierarchies
>> ```
>>
>> So I don't really know where to go from there, any help appreciated.
>> Thanks
>> Alexis
>>