1

After installing Guix, how do I install the bundled SELinux policy, which is intended to allow the guix-daemon.service to run?

To install Guix 1.3.0 on Fedora 34 Workstation, I used the shell installer script:

$ cd /tmp
$ wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
$ chmod +x guix-install.sh
$ sudo ./guix-install.sh

The script completed successfully. I hid its hints and installed the name service cache daemon:

$ sudo dnf install nscd
$ sudo systemctl enable nscd
$ sudo systemctl start nscd

Unfortunately, I cannot proceed with installing glibc-locales because guix-daemon.service is not running:

$ guix install glibc-locales
hint: Consider installing the `glibc-utf8-locales' or `glibc-locales' package and defining `GUIX_LOCPATH', along these lines:

     guix install glibc-utf8-locales
     export GUIX_LOCPATH="$HOME/.guix-profile/lib/locale"

See the "Application Setup" section in the manual, for more info.

guix install: error: failed to connect to `/var/guix/daemon-socket/socket': No such file or directory
$ systemctl status guix-daemon
× guix-daemon.service - Build daemon for GNU Guix
     Loaded: loaded (/etc/systemd/system/guix-daemon.service; enabled; vendor preset: disabled)
     Active: failed (Result: exit-code) since Thu 2021-08-19 21:12:26 EEST; 2h 29min ago
   Main PID: 793 (code=exited, status=203/EXEC)
        CPU: 1ms

сер 19 21:12:26 fedora systemd[1]: Started Build daemon for GNU Guix.
сер 19 21:12:26 fedora systemd[793]: guix-daemon.service: Failed to locate executable /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon: Permission denied
сер 19 21:12:26 fedora systemd[793]: guix-daemon.service: Failed at step EXEC spawning /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon: Permission denied
сер 19 21:12:26 fedora systemd[1]: guix-daemon.service: Main process exited, code=exited, status=203/EXEC
сер 19 21:12:26 fedora systemd[1]: guix-daemon.service: Failed with result 'exit-code'.
сер 19 23:35:07 fedora systemd[1]: /etc/systemd/system/guix-daemon.service:12: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
сер 19 23:35:07 fedora systemd[1]: /etc/systemd/system/guix-daemon.service:13: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.

According to the manual:

Guix includes an SELinux policy file at etc/guix-daemon.cil that can be installed on a system where SELinux is enabled, in order to label Guix files and to specify the expected behavior of the daemon…

The folks on the #guix channel at Libera Chat helped me to figure out that the above instruction is for the manually compiled Guix from git. For Guix installed with the shell installer script, I had to look for the file in /gnu/store:

$ find /gnu -name guix-daemon.cil
/gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/share/selinux/guix-daemon.cil
$ cd /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/share/selinux/
$ sudo semodule -i guix-daemon.cil

Now, the manual says:

Then relabel the file system with restorecon or by a different mechanism provided by your system.

I tried:

$ sudo restorecon -vR /gnu

This returns lots of

restorecon: Could not set context for /gnu/…:  Read-only file system

For example:

$ find /gnu -name guix-daemon.service
/gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service
$ sudo restorecon -v /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service
restorecon: Could not set context for /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service:  Read-only file system

And the daemon still cannot start.

My guess is that the issue is related to SELinux configuration or how Fedora handles it, but I do not understand it to be able to investigate it myself. Searching Guix issue tracker for "Read-only file system" "SELinux" returned just two issues which are not relevant.

1 Answer 1

2

I looked at the guix install script you posted and it looks like it's creating a mount point via systemd to mount /gnu . The part of the install script which does this is

{ # systemd .mount units must be named after the target directory. # Here we assume a hard-coded name of /gnu/store. # XXX Work around https://issues.guix.gnu.org/41356 until next release. if [ -f "~root/.config/guix/current/lib/systemd/system/gnu-store.mount" ]; then cp "~root/.config/guix/current/lib/systemd/system/gnu-store.mount"
/etc/systemd/system/; chmod 664 /etc/systemd/system/gnu-store.mount; systemctl daemon-reload && systemctl enable gnu-store.mount; fi

So this means that you would have to have a file called gnu-store.mount in systemd. I snooped a little more than found out that it has the following contents:

[Unit]
Description=Read-only @storedir@ for GNU Guix
DefaultDependencies=no
ConditionPathExists=@storedir@
Before=guix-daemon.service

[Install]
WantedBy=guix-daemon.service

[Mount]
What=@storedir@
Where=@storedir@
Type=none
Options=bind,ro

If you look at Options=bind,ro , it's definitely read only so you would need to change it to rw, remount and then relabel with restoreconn. Judging by the description, it should not work like this, but I would try it. I hope this helps

2
  • I tried changing ro to rw in /etc/systemd/system/gnu-store.mount and rebooting, but it still was mounted as ro. I unmounted it with sudo umount /gnu/store. Then restorecon was able to complete with messages like …Relabeled /gnu/store/… from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:guix_daemon.guix_store_content_t:s0. So, I believe, the policy is applied now. Still cannot run the daemon, so I will have to look for other issues now. Aug 20, 2021 at 6:53
  • After installing this policy, I cleared the remaining issues with setroubleshoot till the daemon started. (Now looking how to allow guix-daemon to remount in SELinux.) Aug 21, 2021 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.