How to install SELinux policy for guix-daemon.service on Fedora?

Question

After installing Guix, how do I install the bundled SELinux policy, which is intended to allow the guix-daemon.service to run?

To install Guix 1.3.0 on Fedora 34 Workstation, I used the shell installer script:

$ cd /tmp
$ wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
$ chmod +x guix-install.sh
$ sudo ./guix-install.sh

The script completed successfully. I hid its hints and installed the name service cache daemon:

$ sudo dnf install nscd
$ sudo systemctl enable nscd
$ sudo systemctl start nscd

Unfortunately, I cannot proceed with installing glibc-locales because guix-daemon.service is not running:

$ guix install glibc-locales
hint: Consider installing the `glibc-utf8-locales' or `glibc-locales' package and defining `GUIX_LOCPATH', along these lines:

     guix install glibc-utf8-locales
     export GUIX_LOCPATH="$HOME/.guix-profile/lib/locale"

See the "Application Setup" section in the manual, for more info.

guix install: error: failed to connect to `/var/guix/daemon-socket/socket': No such file or directory
$ systemctl status guix-daemon
× guix-daemon.service - Build daemon for GNU Guix
     Loaded: loaded (/etc/systemd/system/guix-daemon.service; enabled; vendor preset: disabled)
     Active: failed (Result: exit-code) since Thu 2021-08-19 21:12:26 EEST; 2h 29min ago
   Main PID: 793 (code=exited, status=203/EXEC)
        CPU: 1ms

сер 19 21:12:26 fedora systemd[1]: Started Build daemon for GNU Guix.
сер 19 21:12:26 fedora systemd[793]: guix-daemon.service: Failed to locate executable /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon: Permission denied
сер 19 21:12:26 fedora systemd[793]: guix-daemon.service: Failed at step EXEC spawning /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon: Permission denied
сер 19 21:12:26 fedora systemd[1]: guix-daemon.service: Main process exited, code=exited, status=203/EXEC
сер 19 21:12:26 fedora systemd[1]: guix-daemon.service: Failed with result 'exit-code'.
сер 19 23:35:07 fedora systemd[1]: /etc/systemd/system/guix-daemon.service:12: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
сер 19 23:35:07 fedora systemd[1]: /etc/systemd/system/guix-daemon.service:13: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.

According to the manual:

Guix includes an SELinux policy file at etc/guix-daemon.cil that can be installed on a system where SELinux is enabled, in order to label Guix files and to specify the expected behavior of the daemon…

The folks on the #guix channel at Libera Chat helped me to figure out that the above instruction is for the manually compiled Guix from git. For Guix installed with the shell installer script, I had to look for the file in /gnu/store:

$ find /gnu -name guix-daemon.cil
/gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/share/selinux/guix-daemon.cil
$ cd /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/share/selinux/
$ sudo semodule -i guix-daemon.cil

Now, the manual says:

Then relabel the file system with restorecon or by a different mechanism provided by your system.

I tried:

$ sudo restorecon -vR /gnu

This returns lots of

restorecon: Could not set context for /gnu/…:  Read-only file system

For example:

$ find /gnu -name guix-daemon.service
/gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service
$ sudo restorecon -v /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service
restorecon: Could not set context for /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service:  Read-only file system

And the daemon still cannot start.

My guess is that the issue is related to SELinux configuration or how Fedora handles it, but I do not understand it to be able to investigate it myself. Searching Guix issue tracker for "Read-only file system" "SELinux" returned just two issues which are not relevant.

Answer 1

I looked at the guix install script you posted and it looks like it's creating a mount point via systemd to mount /gnu . The part of the install script which does this is

{ # systemd .mount units must be named after the target directory. # Here we assume a hard-coded name of /gnu/store. # XXX Work around https://issues.guix.gnu.org/41356 until next release. if [ -f "~root/.config/guix/current/lib/systemd/system/gnu-store.mount" ]; then cp "~root/.config/guix/current/lib/systemd/system/gnu-store.mount"
/etc/systemd/system/; chmod 664 /etc/systemd/system/gnu-store.mount; systemctl daemon-reload && systemctl enable gnu-store.mount; fi

So this means that you would have to have a file called gnu-store.mount in systemd. I snooped a little more than found out that it has the following contents:

[Unit]
Description=Read-only @storedir@ for GNU Guix
DefaultDependencies=no
ConditionPathExists=@storedir@
Before=guix-daemon.service

[Install]
WantedBy=guix-daemon.service

[Mount]
What=@storedir@
Where=@storedir@
Type=none
Options=bind,ro

If you look at Options=bind,ro , it's definitely read only so you would need to change it to rw, remount and then relabel with restoreconn. Judging by the description, it should not work like this, but I would try it. I hope this helps