GNU logs - #78317, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#78317: Unprivileged guix-daemon and SELinux
Resent-From: Ido Yariv <yarivido@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Thu, 08 May 2025 12:54:02 +0000
Resent-Message-ID: <handler.78317.B.17467088266443 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 78317 <at> debbugs.gnu.org
MIME-Version: 1.0
From: Ido Yariv <yarivido@HIDDEN>
Date: Thu, 8 May 2025 08:53:00 -0400
Message-ID: <CAMPn9M=+61f_NcQENzaUDe8iAr8fQnh0BS7zQZMKA2pqU4d8wA@HIDDEN>
Content-Type: multipart/alternative; boundary="00000000000008692a06349f558d"
Received-SPF: pass client-ip=2a00:1450:4864:20::52a;
 envelope-from=yarivido@HIDDEN; helo=mail-ed1-x52a.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: 0.0 (/)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.0 (/)

--00000000000008692a06349f558d
Content-Type: text/plain; charset="UTF-8"

Hi,

It seems that the new unprivileged mode of guix-daemon breaks on some
foreign
distros with SELinux.
More specifically, SELinux prevents guix-daemon from creating & entering
user
namespaces.

The following change seems to mitigate this on Fedora:
--8<---------------cut here---------------start------------->8---
diff --git a/etc/guix-daemon.cil.in b/etc/guix-daemon.cil.in
index b221e31094..d98af865eb 100644
--- a/etc/guix-daemon.cil.in
+++ b/etc/guix-daemon.cil.in
@@ -361,6 +361,14 @@
          self
          (netlink_route_socket (bind create getattr nlmsg_read read write
getopt)))

+  ;; Allow use of user namespaces
+  (allow guix_daemon_t
+         self
+         (cap_userns (sys_admin net_admin sys_chroot)))
+  (allow guix_daemon_t
+         self
+         (user_namespace (create)))
+
   ;; Socket operations
   (allow guix_daemon_t
          guix_daemon_socket_t
--8<---------------cut here---------------end--------------->8---

The second rule requires the user_namespace class to be defined, and might
break
with policies which do not include it (e.g., Rocky Linux 9).

Given that the guix-daemon SELinux policy doesn't quite work out of the box
for
stable releases (cil file is outdated and doesn't include all required
permissions), one suggestion can be to use an unconfined domain for the time
being, at least optionally?

For instance, at least on Fedora and Rocky Linux 9, /gnu's file context can
be
set to usr_t, similar to /usr & /opt, requiring no extra policy:
--8<---------------cut here---------------start------------->8---
sudo semanage fcontext -a -t usr_t '/gnu(/.*)?'
--8<---------------cut here---------------end--------------->8---

More details can be found here: https://danwalsh.livejournal.com/70577.html

It might not be ideal, but it works without any extra tweaking on each
upgrade, and keeps the rest of the system policy enforced.

Thanks,
Ido.

--00000000000008692a06349f558d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<br><br>It seems that the new unprivileged mode of guix=
-daemon breaks on some foreign<br>distros with SELinux.<br>More specificall=
y, SELinux prevents guix-daemon from creating &amp; entering user<br>namesp=
aces.<br><br>The following change seems to mitigate this on Fedora:<br>--8&=
lt;---------------cut here---------------start-------------&gt;8---<br>diff=
 --git a/etc/<a href=3D"http://guix-daemon.cil.in">guix-daemon.cil.in</a> b=
/etc/<a href=3D"http://guix-daemon.cil.in">guix-daemon.cil.in</a><br>index =
b221e31094..d98af865eb 100644<br>--- a/etc/<a href=3D"http://guix-daemon.ci=
l.in">guix-daemon.cil.in</a><br>+++ b/etc/<a href=3D"http://guix-daemon.cil=
.in">guix-daemon.cil.in</a><br>@@ -361,6 +361,14 @@<br>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 self<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (netlink_route_so=
cket (bind create getattr nlmsg_read read write getopt)))<br>=C2=A0<br>+ =
=C2=A0;; Allow use of user namespaces<br>+ =C2=A0(allow guix_daemon_t<br>+ =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 self<br>+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 (cap_user=
ns (sys_admin net_admin sys_chroot)))<br>+ =C2=A0(allow guix_daemon_t<br>+ =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 self<br>+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 (user_nam=
espace (create)))<br>+<br>=C2=A0 =C2=A0;; Socket operations<br>=C2=A0 =C2=
=A0(allow guix_daemon_t<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 guix_daemon_s=
ocket_t<br>--8&lt;---------------cut here---------------end---------------&=
gt;8---<br><br>The second rule requires the user_namespace class to be defi=
ned, and might break<br>with policies which do not include it (e.g., Rocky =
Linux 9).<br><br>Given that the guix-daemon SELinux policy doesn&#39;t quit=
e work out of the box for<br>stable releases (cil file is outdated and does=
n&#39;t include all required<br>permissions), one suggestion can be to use =
an unconfined domain for the time<br>being, at least optionally?<br><br>For=
 instance, at least on Fedora and Rocky Linux 9, /gnu&#39;s file context ca=
n be<br>set to usr_t, similar to /usr &amp; /opt, requiring no extra policy=
:<br>--8&lt;---------------cut here---------------start-------------&gt;8--=
-<br>sudo semanage fcontext -a -t usr_t &#39;/gnu(/.*)?&#39;<br>--8&lt;----=
-----------cut here---------------end---------------&gt;8---<br><br>More de=
tails can be found here: <a href=3D"https://danwalsh.livejournal.com/70577.=
html">https://danwalsh.livejournal.com/70577.html</a><br><br>It might not b=
e ideal, but it works without any extra tweaking on each<br>upgrade, and ke=
eps the rest of the system policy enforced.<br><br>Thanks,<br>Ido.</div>

--00000000000008692a06349f558d--

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Ido Yariv <yarivido@HIDDEN>
Subject: bug#78317: Acknowledgement (Unprivileged guix-daemon and SELinux)
Message-ID: <handler.78317.B.17467088266443.ack <at> debbugs.gnu.org>
References: <CAMPn9M=+61f_NcQENzaUDe8iAr8fQnh0BS7zQZMKA2pqU4d8wA@HIDDEN>
X-Gnu-PR-Message: ack 78317
X-Gnu-PR-Package: guix
Reply-To: 78317 <at> debbugs.gnu.org
Date: Thu, 08 May 2025 12:54:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 78317 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
78317: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D78317
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#78317: Unprivileged guix-daemon and SELinux
Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludovic.courtes@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Thu, 16 Oct 2025 14:26:01 +0000
Resent-Message-ID: <handler.78317.B78317.17606247449544 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Ido Yariv <yarivido@HIDDEN>
Cc: 78317 <at> debbugs.gnu.org
From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludovic.courtes@HIDDEN>
In-Reply-To: <CAMPn9M=+61f_NcQENzaUDe8iAr8fQnh0BS7zQZMKA2pqU4d8wA@HIDDEN>
 (Ido Yariv's message of "Thu, 8 May 2025 08:53:00 -0400")
References: <CAMPn9M=+61f_NcQENzaUDe8iAr8fQnh0BS7zQZMKA2pqU4d8wA@HIDDEN>
Date: Thu, 16 Oct 2025 16:25:16 +0200
Message-ID: <87frbi6i0j.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi Ido,

Ido Yariv <yarivido@HIDDEN> skribis:

> It seems that the new unprivileged mode of guix-daemon breaks on some for=
eign
> distros with SELinux.
> More specifically, SELinux prevents guix-daemon from creating & entering =
user
> namespaces.
>
> The following change seems to mitigate this on Fedora:

[...]

> The second rule requires the user_namespace class to be defined, and migh=
t break
> with policies which do not include it (e.g., Rocky Linux 9).

What would you recommend to support both systems where the
=E2=80=98user_namespace=E2=80=99 class is missing and (newer?) systems wher=
e it=E2=80=99s
available?

Or should we consider that the latter is enough?

> Given that the guix-daemon SELinux policy doesn't quite work out of the b=
ox for
> stable releases (cil file is outdated and doesn't include all required
> permissions), one suggestion can be to use an unconfined domain for the t=
ime
> being, at least optionally?
>
> For instance, at least on Fedora and Rocky Linux 9, /gnu's file context c=
an be
> set to usr_t, similar to /usr & /opt, requiring no extra policy:
> --8<---------------cut here---------------start------------->8---
> sudo semanage fcontext -a -t usr_t '/gnu(/.*)?'
> --8<---------------cut here---------------end--------------->8---

Sounds like a reasonable fallback option.

Thanks for reporting this, and apologies for not noticing earlier.

If you want, you=E2=80=99re welcome to follow up at
<https://codeberg.org/guix/guix/issues/3576>.

Ludo=E2=80=99.

Message received at control <at> debbugs.gnu.org:

Received: (at control) by debbugs.gnu.org; 16 Oct 2025 14:25:57 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Oct 16 10:25:57 2025
Received: from localhost ([127.0.0.1]:36451 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1v9OvU-0002UD-E9
	for submit <at> debbugs.gnu.org; Thu, 16 Oct 2025 10:25:57 -0400
Received: from mail3-relais-sop.national.inria.fr ([192.134.164.104]:25216)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.84_2) (envelope-from <ludovic.courtes@HIDDEN>)
 id 1v9OvC-0002TK-NW
 for control <at> debbugs.gnu.org; Thu, 16 Oct 2025 10:25:39 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc;
 h=date:message-id:to:from:subject:mime-version:
 content-transfer-encoding;
 bh=Uu2c7iwJ0eIS54fr3REw7Lf30YvDjc/03dtQOPpf+Rc=;
 b=aZ+7xMzWPdRyQV/4RxxOfnv1euHuVlmtBrXz7dEBwSrkDLyz2L4uTxSj
 Z4Zxi8Eru6dPDFVAvG//EDCwQwM9WB/4VwCOLY0NzpYDtbJQsaZ+ujPMq
 z5PZQiAMi+c4DnAwoEBr4tuAyy5JwOUrjen00v05X98tNY8wTyQ/14CrQ 8=;
X-CSE-ConnectionGUID: OykfPZ1xSz2bTvsP6seo0A==
X-CSE-MsgGUID: LbG0HasPQPW6kGYjLqdw+Q==
Authentication-Results: mail3-relais-sop.national.inria.fr;
 dkim=none (message not signed) header.i=none;
 spf=SoftFail smtp.mailfrom=ludovic.courtes@HIDDEN;
 dmarc=fail (p=none dis=none) d=inria.fr
X-IronPort-AV: E=Sophos;i="6.19,234,1754949600"; d="scan'208";a="128403873"
Received: from 91-160-117-201.subs.proxad.net (HELO ribbon) ([91.160.117.201])
 by mail3-relais-sop.national.inria.fr with
 ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Oct 2025 16:25:29 +0200
Date: Thu, 16 Oct 2025 16:25:22 +0200
Message-Id: <87ecr26i0d.fsf_-_@HIDDEN>
To: control <at> debbugs.gnu.org
From: =?utf-8?Q?Ludovic_Court=C3=A8s?= <ludovic.courtes@HIDDEN>
Subject: control message for bug #78317
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: control
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

close 78317 
quit

Last modified: Thu, 16 Oct 2025 14:30:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.