From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ricardo Wurmus <rekado@elephly.net>
Subject: Re: SELinux log
Date: Mon, 10 Jun 2019 10:12:35 +0200
Message-ID: <87ef41dfkc.fsf@elephly.net>
References: <CAPNLzUMak3sEm53s=DScGaKSG2ffx6dbPs6aMkpetNzW+5g11A@mail.gmail.com>
 <87sgsocqx5.fsf@elephly.net>
 <CAPNLzUNS-zJTEDWFz8JAgXM5UXM--aiPw_fBn6zTpq+mHfNt4w@mail.gmail.com>
 <87k1dyk33n.fsf@elephly.net>
 <CAPNLzUNRchOyMV=t1guAUcPr+Wg6Ho1pTXeNEYYxhJVod8atYw@mail.gmail.com>
 <87ef4586oh.fsf@elephly.net>
 <CAPNLzUPCGCvVbS=pcHi_9_TY8J9tBTME2aGhu6269HB+TiwJdg@mail.gmail.com>
 <CAPNLzUM3o0irXqsdPMj+utjpPsPas2qHwKVRDJo=N9u5mynpZg@mail.gmail.com>
 <CAPNLzUMu=LYRxc_c5fJAmFv+Ef7nk8iBXUF1ZAGqsjypGk+vgQ@mail.gmail.com>
 <87a7es8spi.fsf@elephly.net>
 <CAPNLzUNbWzw2NkA+n-jxtY5XZcpb_OaxhWprcbwTdbcZg8kMTQ@mail.gmail.com>
 <87r284cer2.fsf@elephly.net>
 <CAPNLzUNiKiz7rT=vN+PtRVmUj97WftH3rPgmumtZdDFyK9kwpw@mail.gmail.com>
 <87muisc8x8.fsf@elephly.net>
 <CAPNLzUPpzp2PL+k3zw_4FaBpO_4VT8T1PYnUHJaV1B_xzRvmOw@mail.gmail.com>
 <CAPNLzUMdJa1nbOeqQLpz9WG==2F=WfbXN052fPOVnd9=-S--Ow@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Return-path: <guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([2001:470:142:3::10]:53287)
 by lists.gnu.org with esmtp (Exim 4.86_2)
 (envelope-from <rekado@elephly.net>) id 1haFQ5-00021w-PI
 for guix-devel@gnu.org; Mon, 10 Jun 2019 04:12:46 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <rekado@elephly.net>) id 1haFQ4-0008Qn-MG
 for guix-devel@gnu.org; Mon, 10 Jun 2019 04:12:45 -0400
Received: from sender4-of-o53.zoho.com ([136.143.188.53]:21344)
 by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
 (Exim 4.71) (envelope-from <rekado@elephly.net>) id 1haFQ4-0008Ou-A2
 for guix-devel@gnu.org; Mon, 10 Jun 2019 04:12:44 -0400
In-reply-to: <CAPNLzUMdJa1nbOeqQLpz9WG==2F=WfbXN052fPOVnd9=-S--Ow@mail.gmail.com>
List-Id: "Development of GNU Guix and the GNU System distribution."
 <guix-devel.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/guix-devel>,
 <mailto:guix-devel-request@gnu.org?subject=unsubscribe>
List-Archive: <https://lists.gnu.org/archive/html/guix-devel>
List-Post: <mailto:guix-devel@gnu.org>
List-Help: <mailto:guix-devel-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/guix-devel>,
 <mailto:guix-devel-request@gnu.org?subject=subscribe>
Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org
Sender: "Guix-devel" <guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org>
To: Laura Lazzati <laura.lazzati.15@gmail.com>
Cc: Guix-devel <guix-devel@gnu.org>


Hi Laura,

> My audit log showed:
>
> type=3DAVC msg=3Daudit(1560131803.485:381): avc:  denied  { search } for
>  pid=3D8177 comm=3D"bash" name=3D"guix" dev=3D"dm-0" ino=3D679365
> scontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tcontext=3Dunconfined_u:object_r:guix_daemon.guix_daemon_conf_t:s0 tclass=
=3Ddir
> permissive=3D0

This looks better.

This says that =E2=80=9Cguix=E2=80=9D is not labeled correctly.  The messag=
e isn=E2=80=99t very
clear, but it looks like bash spawned =E2=80=9Cguix=E2=80=9D, which has no =
particular
SELinux context (unconfined).  When it tries to access /var/guix (which
*does* have the correct label) it is denied access, because only the
guix-daemon type has been granted access to files of type
=E2=80=9Cguix_daemon_conf_t=E2=80=9D.

So we need to figure out what file that =E2=80=9Cguix=E2=80=9D command corr=
esponds to,
so that we can add a rule to the policy to apply the correct label.

--
Ricardo