From: Laura Lazzati <laura.lazzati.15@gmail.com>
To: Ricardo Wurmus <rekado@elephly.net>
Cc: Guix-devel <guix-devel@gnu.org>
Subject: Re: SELinux log
Date: Thu, 6 Jun 2019 22:46:28 -0300 [thread overview]
Message-ID: <CAPNLzUNRchOyMV=t1guAUcPr+Wg6Ho1pTXeNEYYxhJVod8atYw@mail.gmail.com> (raw)
In-Reply-To: <87k1dyk33n.fsf@elephly.net>
Hi!
Hope to shed some light.
I followed all the steps that I hadn't followed before in the
documentation manual about SELinux for guix daemon (ran semodule,
restorecon for all the filesystem and restarted the daemon).
I forgot to set SELinux in permissive mode, so I still got the issue
with the socket.
Then I realized about this, and changed the mode. My log shows that
SELinux would have prevented the daemon from running, like when I had
it in enforcing mode:
-----------------------------------------------start
here-------------------------------------------------------
type=SERVICE_START msg=audit(1559870054.070:258): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=flatpak-system-helper comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'^]UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1559870056.300:259): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=user@42 comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1559870056.340:260): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=user-runtime-dir@42 comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'^]UID="root" AUID="unset"
type=AVC msg=audit(1559870056.930:261): avc: denied { read } for
pid=750 comm="guix-daemon" name="libnss_files.so.2" dev="dm-0"
ino=559459 scontext=system_u:system_r:init_t:s0
tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=lnk_file
permissive=1
type=AVC msg=audit(1559870056.930:262): avc: denied { map } for
pid=750 comm="guix-daemon"
path="/gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/libnss_files-2.28.so"
dev="dm-0" ino=559457 scontext=system_u:system_r:init_t:s0
tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870056.930:263): avc: denied { execute } for
pid=750 comm="guix-daemon"
path="/gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/libnss_files-2.28.so"
dev="dm-0" ino=559457 scontext=system_u:system_r:init_t:s0
tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870056.937:264): avc: denied { create } for
pid=2170 comm="guix-daemon" name="reserved"
scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870056.937:265): avc: denied { write } for
pid=2170 comm="guix-daemon" path="/var/guix/db/reserved" dev="dm-0"
ino=306296 scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870056.940:266): avc: denied { write } for
pid=2170 comm="guix-daemon" name="db.sqlite" dev="dm-0" ino=306225
scontext=system_u:system_r:init_t:s0
tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870056.950:267): avc: denied { setattr } for
pid=2170 comm="guix-daemon" name="db.sqlite-wal" dev="dm-0" ino=306376
scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870056.950:268): avc: denied { map } for
pid=2170 comm="guix-daemon" path="/var/guix/db/db.sqlite-shm"
dev="dm-0" ino=306377 scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870058.000:269): avc: denied { link } for
pid=2170 comm="guix-daemon"
name="7f1alh9qj2h0wwy2220npgnmw6pbrkwx-mirrors" dev="dm-0" ino=551918
scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870058.130:270): avc: denied { rename } for
pid=2170 comm="guix-daemon" name=".tmp-link-2170-1804289383"
dev="dm-0" ino=551930 scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870060.410:271): avc: denied {
execute_no_trans } for pid=2173 comm="guix-daemon"
path="/gnu/store/ncknl03pkmamrxg7q9nxi1rn1qhvwbi9-guix-1.0.1/libexec/guix/substitute"
dev="dm-0" ino=679069 scontext=system_u:system_r:init_t:s0
tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=1
type=AVC msg=audit(1559870060.886:272): avc: denied { name_connect }
for pid=2173 comm=677569782073756273746974757465 dest=443
scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket
permissive=1
type=SERVICE_STOP msg=audit(1559870062.620:273): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1559870070.140:274): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=systemd-localed comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'^]UID="root" AUID="unset"
-----------------------------------------------end
here-------------------------------------------------------
Regards!
Laura
next prev parent reply other threads:[~2019-06-07 1:47 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-04 21:28 SELinux log Laura Lazzati
2019-06-05 9:39 ` Ricardo Wurmus
2019-06-06 14:24 ` Laura Lazzati
2019-06-06 17:58 ` Ricardo Wurmus
2019-06-07 1:46 ` Laura Lazzati [this message]
2019-06-07 20:46 ` Ricardo Wurmus
2019-06-07 23:08 ` Laura Lazzati
2019-06-07 23:10 ` Laura Lazzati
2019-06-07 23:12 ` Laura Lazzati
2019-06-08 7:03 ` Ricardo Wurmus
2019-06-08 14:36 ` Laura Lazzati
2019-06-08 14:50 ` Ricardo Wurmus
2019-06-08 14:57 ` Laura Lazzati
2019-06-08 16:56 ` Ricardo Wurmus
2019-06-09 16:29 ` Laura Lazzati
2019-06-10 2:08 ` Laura Lazzati
2019-06-10 8:12 ` Ricardo Wurmus
2019-06-11 10:48 ` Laura Lazzati
2019-06-11 12:23 ` Ricardo Wurmus
2019-06-12 1:58 ` Laura Lazzati
2019-06-12 6:42 ` Ricardo Wurmus
2019-06-12 13:27 ` Laura Lazzati
2019-06-12 13:34 ` Ricardo Wurmus
2019-06-12 14:25 ` Laura Lazzati
2019-06-12 20:12 ` Ricardo Wurmus
2019-06-12 21:01 ` Laura Lazzati
2019-06-13 6:49 ` Ricardo Wurmus
2019-06-13 17:53 ` Laura Lazzati
2019-06-13 18:52 ` Ricardo Wurmus
2019-06-14 17:24 ` Laura Lazzati
2019-06-16 22:15 ` Laura Lazzati
2019-06-17 1:44 ` Ricardo Wurmus
2019-06-17 3:32 ` Laura Lazzati
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAPNLzUNRchOyMV=t1guAUcPr+Wg6Ho1pTXeNEYYxhJVod8atYw@mail.gmail.com' \
--to=laura.lazzati.15@gmail.com \
--cc=guix-devel@gnu.org \
--cc=rekado@elephly.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.