Re: Stuck installing guix package manager on Fedora with selinux

[Alexis Simon]

Ok I think I'm starting to get somewhere

those are the changes that were needed in the selinux policy to be able 
to start installing a package

==============================================
diff --git a/guix-daemon.cil b/guix-daemon.cil
index 3994e62..c26ed1a 100644
--- a/guix-daemon.cil
+++ b/guix-daemon.cil
@@ -202,7 +202,7 @@
                       sys_admin)))
   (allow guix_daemon_t
          fs_t
-         (filesystem (unmount)))
+         (filesystem (unmount remount)))
   (allow guix_daemon_t
          devpts_t
          (dir (search)))
@@ -308,6 +308,8 @@
          (lnk_file (read)))
   (allow guix_daemon_t NetworkManager_var_run_t
          (dir (search)))
+  (allow guix_daemon_t init_var_run_t
+         (dir (search)))

   ;; Access to profiles
   (allow guix_daemon_t
=============================================

I'll try it out more and update as I go along.

Alexis

On 18/10/2023 10:06, Alexis Simon wrote:
> Hi, Thanks for the suggestion.
>
> I stumbled on this guix rpm but it seems also that selinux needs to be 
> disabled with that one.
> I think the maintainer initially wanted to apply selinux policies but in 
> the end commented out all those parts. (There's also a hint in the 
> changelog that it doesn't work with selinux, see here [0]).
>
> As someone else suggested, yes I could set selinux to permissive but I 
> don't find that an acceptable solution. I don't want to disable a 
> security feature of my system.
>
> Also an update on my initial email: after a reboot, I'm back at square 
> one with the remount error. So the solution wasn't really one.
>
> Best regards,
> Alexis
>
> [0] 
> https://copr-dist-git.fedorainfracloud.org/cgit/lantw44/guix/guix.git/tree/guix.spec?h=f38#n556
>
> On 18/10/2023 06:40, Markku Korkeala wrote:
> > Hi,
> >
> > I haven't tried the official guix installation, but I was
> > able to get guix running on Fedora using rpm packages from copr:
> >
> > https://copr.fedorainfracloud.org/coprs/lantw44/guix/
> >
> > If you can't find solution to the SELinux problem, maybe
> > give those rpm packages a try.
> >
> > Best regards,
> > Markku
> >
> > On Tue, Oct 17, 2023 at 09:42:58AM -0700, Alexis Simon wrote:
> > > Hi,
> > >
> > > I'd like to try the guix package manager but am stuck installing it on
> > > Fedora 38 with selinux. I should say I don't know anything about the 
> > > details
> > > of either guix or selinux.
> > > I know a few other persons that also wanted to try guix but gave up 
> > > due to
> > > issues with selinux, so I think solving this issue could help in 
> > > adoption.
> > >
> > > I've used the installer script which worked well, then was initially 
> > > hit by
> > > this error
> > > `guix install: error: remounting /gnu/store writable: Permission denied`
> > >
> > > This was solved by doing
> > > sudo semodule -i 
> > > /gnu/store/5kj8lyybjrdl7xd0fx9g9vzkz8sklqsy-guix-1.4.0/share/selinux/guix-daemon.cil
> > >
> > > sudo mount -o remount,rw /gnu/store
> > > sudo restorecon -R /gnu /var/guix
> > > sudo systemctl restart guix-daemon.service
> > >
> > > (note that the mount step was the missing part that was missing from all
> > > guides I've seen on the web, and I found it in a guix commit).
> > >
> > > Now I have a different issue, guix-daemon doesn't seem to be able to 
> > > access
> > > internet with errors of the type
> > > `In procedure getaddrinfo: Temporary failure in name resolution`
> > > (disabling selinux works in that case, but I want it enabled)
> > >
> > > This is what I get from setroubleshoot:
> > > ```
> > > SELinux is preventing guix substitute from search access on the 
> > > directory
> > > systemd.
> > > *****  Plugin catchall (100. confidence) suggests   *****
> > > *********************
> > > If you believe that guix substitute should be allowed sea
> > > rch access on the systemd directory by default.
> > > Then you should report this as a bug.
> > > You can generate a local policy module to allow this acce
> > > ss.
> > > Do
> > > allow this access for now by executing:
> > > # ausearch -c 'guix substitute' --raw | audit2allow -M my
> > > -guixsubstitute
> > > # semodule -X 300 -i my-guixsubstitute.pp
> > > ```
> > >
> > > Trying the suggested commands also errors in:
> > > ```
> > > libsepol.hierarchy_add_type_callback: guix_daemon doesn't exist,
> > > guix_daemon.guix_daemon_t is an orphan
> > > libsepol.hierarchy_add_bounds: 1 errors found while adding hierarchies
> > > ```
> > >
> > > So I don't really know where to go from there, any help appreciated.
> > > Thanks
> > > Alexis