bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Daniel Brooks]

It should instead include the guix-daemon.cil file which was built from
it. The .in file has unsubstituted variabels in it which make it useless
as an SELinux policy.

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Marius Bakke]

[-- Attachment #1.1: Type: text/plain, Size: 439 bytes --]

Daniel Brooks <db48x@db48x.net> writes:

> It should instead include the guix-daemon.cil file which was built from
> it. The .in file has unsubstituted variabels in it which make it useless
> as an SELinux policy.

Actually I think both should be included.  The processed file will work
for 99% of users, and the template is needed for the 1% that use a
different store directory.

@Ludo: WDYT about the attached patch for version-1.2.0?


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: 0001-maint-Install-the-processed-SELinux-policy-file-in-a.patch --]
[-- Type: text/x-patch, Size: 1069 bytes --]

From 8b77d853a4c9503df61fb75190d562206d1de1d2 Mon Sep 17 00:00:00 2001
From: Marius Bakke <marius@gnu.org>
Date: Sun, 15 Nov 2020 15:56:04 +0100
Subject: [PATCH] maint: Install the processed SELinux policy file in addition
 to the template.

This fixes <https://bugs.gnu.org/44649>.
Reported by Daniel Brooks <db48x@db48x.net>.

* Makefile.am (dist_selinux_policy_DATA): New target.
---
 Makefile.am | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index 5b84d74f08..4c061db3ca 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -561,8 +561,10 @@ dist_zshcompletion_DATA = etc/completion/zsh/_guix
 # Fish completion file.
 dist_fishcompletion_DATA = etc/completion/fish/guix.fish
 
-# SELinux policy
+# SELinux policy.  Install both the template and the compiled version so
+# it works "out of the box", but can be rebuilt as necessary.
 nodist_selinux_policy_DATA = etc/guix-daemon.cil.in
+dist_selinux_policy_DATA = etc/guix-daemon.cil
 
 EXTRA_DIST +=						\
   HACKING						\
-- 
2.29.2


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Daniel Brooks]

Marius Bakke <marius@gnu.org> writes:

> Actually I think both should be included.  The processed file will work
> for 99% of users, and the template is needed for the 1% that use a
> different store directory.

Fair enough.

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Ludovic Courtès]

Hi,

Daniel Brooks <db48x@db48x.net> skribis:

> It should instead include the guix-daemon.cil file which was built from
> it. The .in file has unsubstituted variabels in it which make it useless
> as an SELinux policy.

Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
your configuration.  What’s wrong with that?

Marius: common practice is to not include instantiated templates; we
wouldn’t use templates in the first place if contents were always the
same.  :-)

Thanks,
Ludo’.

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Tobias Geerinckx-Rice via Bug reports for GNU Guix]

[-- Attachment #1: Type: text/plain, Size: 465 bytes --]

Daniel Brooks 写道：
> Marius Bakke <marius@gnu.org> writes:
>
>> Actually I think both should be included.  The processed file 
>> will work
>> for 99% of users, and the template is needed for the 1% that 
>> use a
>> different store directory.
>
> Fair enough.

Is a pre-generated .cil file required to run ./configure at all on 
some systems?  How's it different from, say, the Makefile which is 
also generated later?

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Daniel Brooks]

Ludovic Courtès <ludo@gnu.org> writes:

> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
> your configuration.  What’s wrong with that?
>
> Marius: common practice is to not include instantiated templates; we
> wouldn’t use templates in the first place if contents were always the
> same.  :-)

That's true; I'd forgotten about that. The reason I mention it is that
it would be nice if guix-install.sh could set up the selinux policy. I
guess this is the only step that would need to run configure.

db48x

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 793 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> Hi,
>
> Daniel Brooks <db48x@db48x.net> skribis:
>
>> It should instead include the guix-daemon.cil file which was built from
>> it. The .in file has unsubstituted variabels in it which make it useless
>> as an SELinux policy.
>
> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
> your configuration.  What’s wrong with that?
>
> Marius: common practice is to not include instantiated templates; we
> wouldn’t use templates in the first place if contents were always the
> same.  :-)

Yes indeed; somehow I thought the bootstrapped tarball also had run
"configure" with the common options, but obviously that's incorrect.

Closing this bug, as there is no reason to special-case this one file.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Ludovic Courtès]

Hi Daniel,

Daniel Brooks <db48x@db48x.net> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
>> your configuration.  What’s wrong with that?
>>
>> Marius: common practice is to not include instantiated templates; we
>> wouldn’t use templates in the first place if contents were always the
>> same.  :-)
>
> That's true; I'd forgotten about that. The reason I mention it is that
> it would be nice if guix-install.sh could set up the selinux policy. I
> guess this is the only step that would need to run configure.

Good point!  The installed ‘guix’ has that file under
share/selinux/guix-daemon.cil, so perhaps the script could copy it from
there?

HTH,
Ludo’.

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Daniel Brooks]

Ludovic Courtès <ludo@gnu.org> writes:

> Good point!  The installed ‘guix’ has that file under
> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
> there?

It only has it if you run configure first.

db48x

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Ludovic Courtès]

Daniel Brooks <db48x@db48x.net> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Good point!  The installed ‘guix’ has that file under
>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>> there?
>
> It only has it if you run configure first.

“The installed ‘guix’” here refers to the one
/var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.

HTH,
Ludo’.

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Daniel Brooks]

Ludovic Courtès <ludo@gnu.org> writes:

>>> Good point!  The installed ‘guix’ has that file under
>>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>>> there?
>>
>> It only has it if you run configure first.
>
> “The installed ‘guix’” here refers to the one
> /var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.

It only has what's in the tarball, which is just guix-daemon.cil.in.

db48x

bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in

[Ludovic Courtès]

Daniel Brooks <db48x@db48x.net> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>>>> Good point!  The installed ‘guix’ has that file under
>>>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>>>> there?
>>>
>>> It only has it if you run configure first.
>>
>> “The installed ‘guix’” here refers to the one
>> /var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.
>
> It only has what's in the tarball, which is just guix-daemon.cil.in.

Oh, got it; now that’s a bug, sorry if I had misunderstood all along!

Now fixed in d4031410375834349bc0d56630be86b076a1d704.

Ludo’.