From: Alexis Simon <alexis.simon@runbox.com>
To: help-guix <help-guix@gnu.org>
Subject: Re: Stuck installing guix package manager on Fedora with selinux
Date: Wed, 18 Oct 2023 11:16:31 -0700 [thread overview]
Message-ID: <70b51103-89af-4489-a1d2-e44ecba15062@runbox.com> (raw)
In-Reply-To: <0e7b887d-2a0f-4675-8e0a-569b82d155ad@runbox.com>
Ok I think I'm starting to get somewhere
those are the changes that were needed in the selinux policy to be able
to start installing a package
==============================================
diff --git a/guix-daemon.cil b/guix-daemon.cil
index 3994e62..c26ed1a 100644
--- a/guix-daemon.cil
+++ b/guix-daemon.cil
@@ -202,7 +202,7 @@
sys_admin)))
(allow guix_daemon_t
fs_t
- (filesystem (unmount)))
+ (filesystem (unmount remount)))
(allow guix_daemon_t
devpts_t
(dir (search)))
@@ -308,6 +308,8 @@
(lnk_file (read)))
(allow guix_daemon_t NetworkManager_var_run_t
(dir (search)))
+ (allow guix_daemon_t init_var_run_t
+ (dir (search)))
;; Access to profiles
(allow guix_daemon_t
=============================================
I'll try it out more and update as I go along.
Alexis
On 18/10/2023 10:06, Alexis Simon wrote:
> Hi, Thanks for the suggestion.
>
> I stumbled on this guix rpm but it seems also that selinux needs to be
> disabled with that one.
> I think the maintainer initially wanted to apply selinux policies but in
> the end commented out all those parts. (There's also a hint in the
> changelog that it doesn't work with selinux, see here [0]).
>
> As someone else suggested, yes I could set selinux to permissive but I
> don't find that an acceptable solution. I don't want to disable a
> security feature of my system.
>
> Also an update on my initial email: after a reboot, I'm back at square
> one with the remount error. So the solution wasn't really one.
>
> Best regards,
> Alexis
>
> [0]
> https://copr-dist-git.fedorainfracloud.org/cgit/lantw44/guix/guix.git/tree/guix.spec?h=f38#n556
>
> On 18/10/2023 06:40, Markku Korkeala wrote:
>> Hi,
>>
>> I haven't tried the official guix installation, but I was
>> able to get guix running on Fedora using rpm packages from copr:
>>
>> https://copr.fedorainfracloud.org/coprs/lantw44/guix/
>>
>> If you can't find solution to the SELinux problem, maybe
>> give those rpm packages a try.
>>
>> Best regards,
>> Markku
>>
>> On Tue, Oct 17, 2023 at 09:42:58AM -0700, Alexis Simon wrote:
>>> Hi,
>>>
>>> I'd like to try the guix package manager but am stuck installing it on
>>> Fedora 38 with selinux. I should say I don't know anything about the
>>> details
>>> of either guix or selinux.
>>> I know a few other persons that also wanted to try guix but gave up
>>> due to
>>> issues with selinux, so I think solving this issue could help in
>>> adoption.
>>>
>>> I've used the installer script which worked well, then was initially
>>> hit by
>>> this error
>>> `guix install: error: remounting /gnu/store writable: Permission denied`
>>>
>>> This was solved by doing
>>> sudo semodule -i
>>> /gnu/store/5kj8lyybjrdl7xd0fx9g9vzkz8sklqsy-guix-1.4.0/share/selinux/guix-daemon.cil
>>>
>>> sudo mount -o remount,rw /gnu/store
>>> sudo restorecon -R /gnu /var/guix
>>> sudo systemctl restart guix-daemon.service
>>>
>>> (note that the mount step was the missing part that was missing from all
>>> guides I've seen on the web, and I found it in a guix commit).
>>>
>>> Now I have a different issue, guix-daemon doesn't seem to be able to
>>> access
>>> internet with errors of the type
>>> `In procedure getaddrinfo: Temporary failure in name resolution`
>>> (disabling selinux works in that case, but I want it enabled)
>>>
>>> This is what I get from setroubleshoot:
>>> ```
>>> SELinux is preventing guix substitute from search access on the
>>> directory
>>> systemd.
>>> ***** Plugin catchall (100. confidence) suggests *****
>>> *********************
>>> If you believe that guix substitute should be allowed sea
>>> rch access on the systemd directory by default.
>>> Then you should report this as a bug.
>>> You can generate a local policy module to allow this acce
>>> ss.
>>> Do
>>> allow this access for now by executing:
>>> # ausearch -c 'guix substitute' --raw | audit2allow -M my
>>> -guixsubstitute
>>> # semodule -X 300 -i my-guixsubstitute.pp
>>> ```
>>>
>>> Trying the suggested commands also errors in:
>>> ```
>>> libsepol.hierarchy_add_type_callback: guix_daemon doesn't exist,
>>> guix_daemon.guix_daemon_t is an orphan
>>> libsepol.hierarchy_add_bounds: 1 errors found while adding hierarchies
>>> ```
>>>
>>> So I don't really know where to go from there, any help appreciated.
>>> Thanks
>>> Alexis
>>>
>
next prev parent reply other threads:[~2023-10-18 18:17 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-17 16:42 Stuck installing guix package manager on Fedora with selinux Alexis Simon
2023-10-18 13:40 ` Markku Korkeala
2023-10-18 17:06 ` Alexis Simon
2023-10-18 18:16 ` Alexis Simon [this message]
2023-10-19 2:02 ` Maxim Cournoyer
2023-10-19 3:22 ` Alexis Simon
2023-10-19 3:36 ` Maxim Cournoyer
2023-10-20 11:32 ` Markku Korkeala
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=70b51103-89af-4489-a1d2-e44ecba15062@runbox.com \
--to=alexis.simon@runbox.com \
--cc=help-guix@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.