Received: (at submit) by debbugs.gnu.org; 28 Oct 2024 04:01:59 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Oct 28 00:01:59 2024
Received: from localhost ([127.0.0.1]:50038 helo=debbugs.gnu.org)
by debbugs.gnu.org with esmtp (Exim 4.84_2)
(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
id 1t5Gx4-0003on-Ec
for submit <at> debbugs.gnu.org; Mon, 28 Oct 2024 00:01:59 -0400
Received: from lists.gnu.org ([209.51.188.17]:39700)
by debbugs.gnu.org with esmtp (Exim 4.84_2)
(envelope-from <pasta@HIDDEN>) id 1t5Gx2-0003oT-E6
for submit <at> debbugs.gnu.org; Mon, 28 Oct 2024 00:01:57 -0400
Received: from eggs.gnu.org ([2001:470:142:3::10])
by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.90_1) (envelope-from <pasta@HIDDEN>) id 1t5GwM-0003kp-AA
for bug-guix@HIDDEN; Mon, 28 Oct 2024 00:01:18 -0400
Received: from mail-wr1-x435.google.com ([2a00:1450:4864:20::435])
by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
(Exim 4.90_1) (envelope-from <pasta@HIDDEN>) id 1t5GwF-0001NZ-Ul
for bug-guix@HIDDEN; Mon, 28 Oct 2024 00:01:13 -0400
Received: by mail-wr1-x435.google.com with SMTP id
ffacd0b85a97d-37f52925fc8so2786084f8f.1
for <bug-guix@HIDDEN>; Sun, 27 Oct 2024 21:01:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=dash.org; s=dash; t=1730088063; x=1730692863; darn=gnu.org;
h=content-transfer-encoding:to:subject:message-id:date:from
:in-reply-to:references:mime-version:from:to:cc:subject:date
:message-id:reply-to;
bh=iSpKxevTvozkiAXH+soi8zAkk9k4bIRm7bzg+DE4ET8=;
b=CURX1moNVO/EyQzYBmFV4L7Uq6kIQJkqDG/4v4N3sHfU7E2wzeGN7VAB3Ajbr2Jufl
1NRhQSxUzOB2FkSbFU+4DqYwI5pVtuYjnQnNPbjUeryxJfKerPeHw6l9IObvxTINEbQg
0iJcITBzvzKWFds+AqH/yQuQGbF/a6EUbriDMnHZ8921poE3tPqbLtD+Hz/Nso7faEJq
nsxOPMnpVYWXn7OvSa7u/QHwOaj5MmJ97yx1z8HHjbrH5OjN9Tk+7ZATKcbrrhbK9NGY
PZZ414oY8928XrcQo6wMf3BRfGIA+I6Hp11et2OgpqWV7pZbZCGlumwYBXX+N3uzJ7XN
2/Mg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1730088063; x=1730692863;
h=content-transfer-encoding:to:subject:message-id:date:from
:in-reply-to:references:mime-version:x-gm-message-state:from:to:cc
:subject:date:message-id:reply-to;
bh=iSpKxevTvozkiAXH+soi8zAkk9k4bIRm7bzg+DE4ET8=;
b=WcnYHsk7bQyXkTnAAEDno/ulnAJ3EzMVQDrH01fDsS2JhvlPTSdsyG3k8F+1Q1xZPX
MYCK3xkgO1pHEpag3KE3czgsYSifr7esWOBfOb2B3hsw8Y1HSVjiMXl9E3op/jS1EKzN
hoCVf8a5TWvWM+RAEXVX+nBCFuR0BvlJ4Qyuy7mTokx1nCcIcvXmaQsXuKl0QTVaq7U3
8MLOoEEJMEK82i6XvFn0W4KnI4nfW+2l8TiZHaHdAWDHtUM+0OxQmt3B4Dql14+WZfun
k/iGE6LquWJcRCUm5NVmeHdbnw4euS9IZ+LghSxUXln6QetjpiWvbzMOrX+kwmnj3WaL
L1bg==
X-Gm-Message-State: AOJu0YwpBW/0jLq5N8fDHUnplBa/dH+eG6HGruBzKnS7kla1yKS01fXm
pRJbVgSZ8uXgCfEZD5sP62UkHZC+274MR/2j+1eRXVyFYFSXFh/LtXxkbfDTCfdwwJZjSYJD6Aa
5KuxV/fW44mwT1OKhwBjhWULQQYCsT/H+AuwjqL6e+LlSJb7JUBU=
X-Google-Smtp-Source: AGHT+IEVL78dVf5H71BR4cfdjjhKMgremb+HEV4u34FsXuRafPZUbKg1PXZTEx5HhlORSKZEfPvSfys2KFfzt414ufY=
X-Received: by 2002:adf:edc9:0:b0:378:89d8:8242 with SMTP id
ffacd0b85a97d-38061163b1dmr4657877f8f.26.1730088062908; Sun, 27 Oct 2024
21:01:02 -0700 (PDT)
MIME-Version: 1.0
References: <CA+493-qsAeZgZQFnoT+VYCJ5GJCjC4TObS4yRWS9=Hg98G6Beg@HIDDEN>
In-Reply-To: <CA+493-qsAeZgZQFnoT+VYCJ5GJCjC4TObS4yRWS9=Hg98G6Beg@HIDDEN>
From: Pasta Pasta <pasta@HIDDEN>
Date: Sun, 27 Oct 2024 23:00:51 -0500
Message-ID: <CA+493-otf8=RBq79vPyGBONOHKXFB08p-v2Nv4JOSL762VoQKA@HIDDEN>
Subject: Re: Unable to run `guix pull` on Fedora (Asahi) due to SELinux
violations
To: bug-guix@HIDDEN
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Received-SPF: pass client-ip=2a00:1450:4864:20::435;
envelope-from=pasta@HIDDEN; helo=mail-wr1-x435.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.4 (-)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>,
<mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>,
<mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.4 (--)
Hi!
Is anyone to evaluate this?
Thanks!
On Sat, Sep 28, 2024 at 11:01=E2=80=AFPM Pasta Pasta <pasta@HIDDEN> wrote=
:
>
> Hi all,
>
> I installed guix via
> https://guix.gnu.org/manual/en/html_node/Binary-Installation.html
> specifically
> ```
> cd /tmp
> wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
> chmod +x guix-install.sh
> sudo ./guix-install.sh
> ```
>
> I then tried to follow the docs here:
> https://guix.gnu.org/manual/en/html_node/SELinux-Support.html related
> to SELinux
>
> I ended up running
> ```
> sudo semodule -i
> /gnu/store/271mkw93sqb3hc4ngszcjfsc2wsb6yc8-guix-1.4.0/share/selinux/guix=
-daemon.cil
> ```
>
> As this was the only file I found that looked right according to the
> docs such as `semodule -i etc/guix-daemon.cil`
>
> I've restarted my system a few times, however, I am still getting
> SELinux violations resulting in
> ```
> $ guix pull
> guix pull: error: remounting /gnu/store writable: Permission denied
> ```
>
> see the detailed SELinux violation report
>
> ```
> SELinux is preventing guix-daemon from remount access on the filesystem .
>
> ***** Plugin catchall (100. confidence) suggests *********************=
*****
>
> If you believe that guix-daemon should be allowed remount access on
> the filesystem by default.
> Then you should report this as a bug.
> You can generate a local policy module to allow this access.
> Do
> allow this access for now by executing:
> # ausearch -c 'guix-daemon' --raw | audit2allow -M my-guixdaemon
> # semodule -X 300 -i my-guixdaemon.pp
>
> Additional Information:
> Source Context system_u:system_r:guix_daemon.guix_daemon_t=
:s0
> Target Context system_u:object_r:fs_t:s0
> Target Objects [ filesystem ]
> Source guix-daemon
> Source Path guix-daemon
> Port <Unknown>
> Host pasta-macbookpro-asahi
> Source RPM Packages
> Target RPM Packages
> SELinux Policy RPM selinux-policy-targeted-40.27-1.fc40.noarch
> Local Policy RPM
> Selinux Enabled True
> Policy Type targeted
> Enforcing Mode Enforcing
> Host Name pasta-macbookpro-asahi
> Platform Linux pasta-macbookpro-asahi
> 6.11.0-400.asahi.fc40.aarch64+16k #1 SMP
> PREEMPT_DYNAMIC Fri Sep 27 02:59:31 UTC 202=
4
> aarch64
> Alert Count 12
> First Seen 2024-09-28 22:37:00 CDT
> Last Seen 2024-09-28 22:51:58 CDT
> Local ID 00bfc2a9-edf9-49d4-9f98-aaff428092a2
>
> Raw Audit Messages
> type=3DAVC msg=3Daudit(1727581918.607:304): avc: denied { remount } for
> pid=3D3363 comm=3D"guix-daemon"
> scontext=3Dsystem_u:system_r:guix_daemon.guix_daemon_t:s0
> tcontext=3Dsystem_u:object_r:fs_t:s0 tclass=3Dfilesystem permissive=3D0
>
>
> Hash: guix-daemon,guix_daemon.guix_daemon_t,fs_t,filesystem,remount
> ```
>
> I tried running the recommended steps by SELinux, but that did not work.
>
> Please advise!
bug-guix@HIDDEN:bug#73547; Package guix.
Full text available.
Received: (at submit) by debbugs.gnu.org; 29 Sep 2024 07:01:08 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Sep 29 03:01:08 2024
Received: from localhost ([127.0.0.1]:36946 helo=debbugs.gnu.org)
by debbugs.gnu.org with esmtp (Exim 4.84_2)
(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
id 1sunvX-0001SA-3D
for submit <at> debbugs.gnu.org; Sun, 29 Sep 2024 03:01:08 -0400
Received: from lists.gnu.org ([209.51.188.17]:53174)
by debbugs.gnu.org with esmtp (Exim 4.84_2)
(envelope-from <pasta@HIDDEN>) id 1sul85-00005w-Va
for submit <at> debbugs.gnu.org; Sun, 29 Sep 2024 00:01:55 -0400
Received: from eggs.gnu.org ([2001:470:142:3::10])
by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.90_1) (envelope-from <pasta@HIDDEN>) id 1sul7Z-0005Ml-VX
for bug-guix@HIDDEN; Sun, 29 Sep 2024 00:01:22 -0400
Received: from mail-ed1-x533.google.com ([2a00:1450:4864:20::533])
by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
(Exim 4.90_1) (envelope-from <pasta@HIDDEN>) id 1sul7Y-0007xP-2Y
for bug-guix@HIDDEN; Sun, 29 Sep 2024 00:01:21 -0400
Received: by mail-ed1-x533.google.com with SMTP id
4fb4d7f45d1cf-5c8844f0ccaso2432552a12.0
for <bug-guix@HIDDEN>; Sat, 28 Sep 2024 21:01:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=dash.org; s=dash; t=1727582477; x=1728187277; darn=gnu.org;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=Mw30/utXaHNFJrB4yFgUOd0yHN3mRmkVdOp2T+lASvQ=;
b=E+a85lYRCuCG7maJdDkOMbVE6NLmft6AGf3c/nPeweLPyrvdX9JtCKkmuQTa0H8qbL
tdJfArG4Y726YMTygDQqYKrSHfM+pSEMq30vJ3O8mg8gJIemRtFG89RUaNePbR2A+/2D
s/RxV9ZWOIxMmLxYD86236Ajuo8ozptjn5uW8ScXOwAJ7ZCRdCH27YdCIG56vvwq/p+D
0ia80IJUEg9IJoJs7fqo2sLXOsA/ZtgHB3N8Im/P/aAVS9RIZo736WJDAsPWWtAJyFG7
XaZptBeVdBMQBWubXzz6IeTUw2zZtz7I9dFa+CY9ZjStw8LR8N+//vntCVBhYHaFw5g2
DEDw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1727582477; x=1728187277;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=Mw30/utXaHNFJrB4yFgUOd0yHN3mRmkVdOp2T+lASvQ=;
b=dG0TqYSLsRzY7fFBEwqa8i1ppc2gZncTna2bL8MYncp6IknbtPquPPBw+XgQYWOhnt
CdMO/v0gngW4BeqGRh4ufiodV04Hq5YdXtlvDWj+XrQaujgCwI8G/z/yLVQclxw2aUer
990PVcIlzZOO6kB+DyYTVVizJUnqmTiVvtThEBiqK4cmUbfw/XIWKdkGxv3VKb5t3OXm
kURw1epXwuBj4FCYRXshHQALHM3eZscgDP52jK4WjibEw7wYGEyR26Cyn/awjAinzYhm
y8TeL/sJKSvrioNPHVeqtqmzJvy/1PdcGrf/X4oLqLAGLDUJ4aXxWci9NuiKCSGs9BXO
z8NA==
X-Gm-Message-State: AOJu0YwBs+nORXCCZF3hOwT9PAFkuqQVMqz/I+asgh/HvVr13tjdv1aO
cJCCDDZ6vhigw5GFy+18zzy/+YLGOhSV7Xdw4NxhtqzfG9GwEbo0fovIWbjbPSRjWymD+LSIbxk
FqwQOUpMNysaRC+3YTgYxFvgGGU5gaQnxWwWELtMIQPO5hTeCE78=
X-Google-Smtp-Source: AGHT+IF5EGB1D9DRUpG6fMhfSuhSl/d5Px75eUNag9mXzhmImjZr3ZWCdhXYUad17tyGNuGHU6NNgcI7eeLOa34jat0=
X-Received: by 2002:a17:907:3e9e:b0:a8a:78bb:1e2 with SMTP id
a640c23a62f3a-a93c48e7d14mr829914966b.6.1727582477156; Sat, 28 Sep 2024
21:01:17 -0700 (PDT)
MIME-Version: 1.0
From: Pasta Pasta <pasta@HIDDEN>
Date: Sat, 28 Sep 2024 23:01:06 -0500
Message-ID: <CA+493-qsAeZgZQFnoT+VYCJ5GJCjC4TObS4yRWS9=Hg98G6Beg@HIDDEN>
Subject: Unable to run `guix pull` on Fedora (Asahi) due to SELinux violations
To: bug-guix@HIDDEN
Content-Type: text/plain; charset="UTF-8"
Received-SPF: pass client-ip=2a00:1450:4864:20::533;
envelope-from=pasta@HIDDEN; helo=mail-ed1-x533.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001,
SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.4 (-)
X-Debbugs-Envelope-To: submit
X-Mailman-Approved-At: Sun, 29 Sep 2024 03:01:06 -0400
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>,
<mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>,
<mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.4 (--)
Hi all,
I installed guix via
https://guix.gnu.org/manual/en/html_node/Binary-Installation.html
specifically
```
cd /tmp
wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
chmod +x guix-install.sh
sudo ./guix-install.sh
```
I then tried to follow the docs here:
https://guix.gnu.org/manual/en/html_node/SELinux-Support.html related
to SELinux
I ended up running
```
sudo semodule -i
/gnu/store/271mkw93sqb3hc4ngszcjfsc2wsb6yc8-guix-1.4.0/share/selinux/guix-daemon.cil
```
As this was the only file I found that looked right according to the
docs such as `semodule -i etc/guix-daemon.cil`
I've restarted my system a few times, however, I am still getting
SELinux violations resulting in
```
$ guix pull
guix pull: error: remounting /gnu/store writable: Permission denied
```
see the detailed SELinux violation report
```
SELinux is preventing guix-daemon from remount access on the filesystem .
***** Plugin catchall (100. confidence) suggests **************************
If you believe that guix-daemon should be allowed remount access on
the filesystem by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'guix-daemon' --raw | audit2allow -M my-guixdaemon
# semodule -X 300 -i my-guixdaemon.pp
Additional Information:
Source Context system_u:system_r:guix_daemon.guix_daemon_t:s0
Target Context system_u:object_r:fs_t:s0
Target Objects [ filesystem ]
Source guix-daemon
Source Path guix-daemon
Port <Unknown>
Host pasta-macbookpro-asahi
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-40.27-1.fc40.noarch
Local Policy RPM
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name pasta-macbookpro-asahi
Platform Linux pasta-macbookpro-asahi
6.11.0-400.asahi.fc40.aarch64+16k #1 SMP
PREEMPT_DYNAMIC Fri Sep 27 02:59:31 UTC 2024
aarch64
Alert Count 12
First Seen 2024-09-28 22:37:00 CDT
Last Seen 2024-09-28 22:51:58 CDT
Local ID 00bfc2a9-edf9-49d4-9f98-aaff428092a2
Raw Audit Messages
type=AVC msg=audit(1727581918.607:304): avc: denied { remount } for
pid=3363 comm="guix-daemon"
scontext=system_u:system_r:guix_daemon.guix_daemon_t:s0
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0
Hash: guix-daemon,guix_daemon.guix_daemon_t,fs_t,filesystem,remount
```
I tried running the recommended steps by SELinux, but that did not work.
Please advise!
Pasta Pasta <pasta@HIDDEN>:bug-guix@HIDDEN.
Full text available.bug-guix@HIDDEN:bug#73547; Package guix.
Full text available.
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997 nCipher Corporation Ltd,
1994-97 Ian Jackson.