GNU logs - #73547, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#73547: Unable to run `guix pull` on Fedora (Asahi) due to SELinux violations
Resent-From: Pasta Pasta <pasta@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Sun, 29 Sep 2024 07:02:01 +0000
Resent-Message-ID: <handler.73547.B.17275932685598 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 73547 <at> debbugs.gnu.org
MIME-Version: 1.0
From: Pasta Pasta <pasta@HIDDEN>
Date: Sat, 28 Sep 2024 23:01:06 -0500
Message-ID: <CA+493-qsAeZgZQFnoT+VYCJ5GJCjC4TObS4yRWS9=Hg98G6Beg@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
Received-SPF: pass client-ip=2a00:1450:4864:20::533;
 envelope-from=pasta@HIDDEN; helo=mail-ed1-x533.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.4 (-)
X-Mailman-Approved-At: Sun, 29 Sep 2024 03:01:06 -0400
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.4 (--)

Hi all,

I installed guix via
https://guix.gnu.org/manual/en/html_node/Binary-Installation.html
specifically
```
cd /tmp
wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
chmod +x guix-install.sh
sudo ./guix-install.sh
```

I then tried to follow the docs here:
https://guix.gnu.org/manual/en/html_node/SELinux-Support.html related
to SELinux

I ended up running
```
sudo semodule -i
/gnu/store/271mkw93sqb3hc4ngszcjfsc2wsb6yc8-guix-1.4.0/share/selinux/guix-daemon.cil
```

As this was the only file I found that looked right according to the
docs such as `semodule -i etc/guix-daemon.cil`

I've restarted my system a few times, however, I am still getting
SELinux violations resulting in
```
$ guix pull
guix pull: error: remounting /gnu/store writable: Permission denied
```

see the detailed SELinux violation report

```
SELinux is preventing guix-daemon from remount access on the filesystem .

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that guix-daemon should be allowed remount access on
the  filesystem by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'guix-daemon' --raw | audit2allow -M my-guixdaemon
# semodule -X 300 -i my-guixdaemon.pp

Additional Information:
Source Context                system_u:system_r:guix_daemon.guix_daemon_t:s0
Target Context                system_u:object_r:fs_t:s0
Target Objects                 [ filesystem ]
Source                        guix-daemon
Source Path                   guix-daemon
Port                          <Unknown>
Host                          pasta-macbookpro-asahi
Source RPM Packages
Target RPM Packages
SELinux Policy RPM            selinux-policy-targeted-40.27-1.fc40.noarch
Local Policy RPM
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     pasta-macbookpro-asahi
Platform                      Linux pasta-macbookpro-asahi
                              6.11.0-400.asahi.fc40.aarch64+16k #1 SMP
                              PREEMPT_DYNAMIC Fri Sep 27 02:59:31 UTC 2024
                              aarch64
Alert Count                   12
First Seen                    2024-09-28 22:37:00 CDT
Last Seen                     2024-09-28 22:51:58 CDT
Local ID                      00bfc2a9-edf9-49d4-9f98-aaff428092a2

Raw Audit Messages
type=AVC msg=audit(1727581918.607:304): avc:  denied  { remount } for
pid=3363 comm="guix-daemon"
scontext=system_u:system_r:guix_daemon.guix_daemon_t:s0
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0


Hash: guix-daemon,guix_daemon.guix_daemon_t,fs_t,filesystem,remount
```

I tried running the recommended steps by SELinux, but that did not work.

Please advise!

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Pasta Pasta <pasta@HIDDEN>
Subject: bug#73547: Acknowledgement (Unable to run `guix pull` on Fedora
 (Asahi) due to SELinux violations)
Message-ID: <handler.73547.B.17275932685598.ack <at> debbugs.gnu.org>
References: <CA+493-qsAeZgZQFnoT+VYCJ5GJCjC4TObS4yRWS9=Hg98G6Beg@HIDDEN>
X-Gnu-PR-Message: ack 73547
X-Gnu-PR-Package: guix
Reply-To: 73547 <at> debbugs.gnu.org
Date: Sun, 29 Sep 2024 07:02:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 73547 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
73547: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D73547
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#73547: Unable to run `guix pull` on Fedora (Asahi) due to SELinux violations
Resent-From: Pasta Pasta <pasta@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Mon, 28 Oct 2024 04:02:02 +0000
Resent-Message-ID: <handler.73547.B.173008811914689 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 73547 <at> debbugs.gnu.org
MIME-Version: 1.0
References: <CA+493-qsAeZgZQFnoT+VYCJ5GJCjC4TObS4yRWS9=Hg98G6Beg@HIDDEN>
In-Reply-To: <CA+493-qsAeZgZQFnoT+VYCJ5GJCjC4TObS4yRWS9=Hg98G6Beg@HIDDEN>
From: Pasta Pasta <pasta@HIDDEN>
Date: Sun, 27 Oct 2024 23:00:51 -0500
Message-ID: <CA+493-otf8=RBq79vPyGBONOHKXFB08p-v2Nv4JOSL762VoQKA@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Received-SPF: pass client-ip=2a00:1450:4864:20::435;
 envelope-from=pasta@HIDDEN; helo=mail-wr1-x435.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.4 (-)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.4 (--)

Hi!

Is anyone to evaluate this?

Thanks!

On Sat, Sep 28, 2024 at 11:01=E2=80=AFPM Pasta Pasta <pasta@HIDDEN> wrote=
:
>
> Hi all,
>
> I installed guix via
> https://guix.gnu.org/manual/en/html_node/Binary-Installation.html
> specifically
> ```
> cd /tmp
> wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
> chmod +x guix-install.sh
> sudo ./guix-install.sh
> ```
>
> I then tried to follow the docs here:
> https://guix.gnu.org/manual/en/html_node/SELinux-Support.html related
> to SELinux
>
> I ended up running
> ```
> sudo semodule -i
> /gnu/store/271mkw93sqb3hc4ngszcjfsc2wsb6yc8-guix-1.4.0/share/selinux/guix=
-daemon.cil
> ```
>
> As this was the only file I found that looked right according to the
> docs such as `semodule -i etc/guix-daemon.cil`
>
> I've restarted my system a few times, however, I am still getting
> SELinux violations resulting in
> ```
> $ guix pull
> guix pull: error: remounting /gnu/store writable: Permission denied
> ```
>
> see the detailed SELinux violation report
>
> ```
> SELinux is preventing guix-daemon from remount access on the filesystem .
>
> *****  Plugin catchall (100. confidence) suggests   *********************=
*****
>
> If you believe that guix-daemon should be allowed remount access on
> the  filesystem by default.
> Then you should report this as a bug.
> You can generate a local policy module to allow this access.
> Do
> allow this access for now by executing:
> # ausearch -c 'guix-daemon' --raw | audit2allow -M my-guixdaemon
> # semodule -X 300 -i my-guixdaemon.pp
>
> Additional Information:
> Source Context                system_u:system_r:guix_daemon.guix_daemon_t=
:s0
> Target Context                system_u:object_r:fs_t:s0
> Target Objects                 [ filesystem ]
> Source                        guix-daemon
> Source Path                   guix-daemon
> Port                          <Unknown>
> Host                          pasta-macbookpro-asahi
> Source RPM Packages
> Target RPM Packages
> SELinux Policy RPM            selinux-policy-targeted-40.27-1.fc40.noarch
> Local Policy RPM
> Selinux Enabled               True
> Policy Type                   targeted
> Enforcing Mode                Enforcing
> Host Name                     pasta-macbookpro-asahi
> Platform                      Linux pasta-macbookpro-asahi
>                               6.11.0-400.asahi.fc40.aarch64+16k #1 SMP
>                               PREEMPT_DYNAMIC Fri Sep 27 02:59:31 UTC 202=
4
>                               aarch64
> Alert Count                   12
> First Seen                    2024-09-28 22:37:00 CDT
> Last Seen                     2024-09-28 22:51:58 CDT
> Local ID                      00bfc2a9-edf9-49d4-9f98-aaff428092a2
>
> Raw Audit Messages
> type=3DAVC msg=3Daudit(1727581918.607:304): avc:  denied  { remount } for
> pid=3D3363 comm=3D"guix-daemon"
> scontext=3Dsystem_u:system_r:guix_daemon.guix_daemon_t:s0
> tcontext=3Dsystem_u:object_r:fs_t:s0 tclass=3Dfilesystem permissive=3D0
>
>
> Hash: guix-daemon,guix_daemon.guix_daemon_t,fs_t,filesystem,remount
> ```
>
> I tried running the recommended steps by SELinux, but that did not work.
>
> Please advise!

Last modified: Sun, 12 Jan 2025 05:45:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.