After installing Guix, how do I install the bundled SELinux policy, which is intended to allow the guix-daemon.service
to run?
To install Guix 1.3.0 on Fedora 34 Workstation, I used the shell installer script:
$ cd /tmp
$ wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
$ chmod +x guix-install.sh
$ sudo ./guix-install.sh
The script completed successfully. I hid its hints and installed the name service cache daemon:
$ sudo dnf install nscd
$ sudo systemctl enable nscd
$ sudo systemctl start nscd
Unfortunately, I cannot proceed with installing glibc-locales
because guix-daemon.service
is not running:
$ guix install glibc-locales
hint: Consider installing the `glibc-utf8-locales' or `glibc-locales' package and defining `GUIX_LOCPATH', along these lines:
guix install glibc-utf8-locales
export GUIX_LOCPATH="$HOME/.guix-profile/lib/locale"
See the "Application Setup" section in the manual, for more info.
guix install: error: failed to connect to `/var/guix/daemon-socket/socket': No such file or directory
$ systemctl status guix-daemon
× guix-daemon.service - Build daemon for GNU Guix
Loaded: loaded (/etc/systemd/system/guix-daemon.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Thu 2021-08-19 21:12:26 EEST; 2h 29min ago
Main PID: 793 (code=exited, status=203/EXEC)
CPU: 1ms
сер 19 21:12:26 fedora systemd[1]: Started Build daemon for GNU Guix.
сер 19 21:12:26 fedora systemd[793]: guix-daemon.service: Failed to locate executable /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon: Permission denied
сер 19 21:12:26 fedora systemd[793]: guix-daemon.service: Failed at step EXEC spawning /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon: Permission denied
сер 19 21:12:26 fedora systemd[1]: guix-daemon.service: Main process exited, code=exited, status=203/EXEC
сер 19 21:12:26 fedora systemd[1]: guix-daemon.service: Failed with result 'exit-code'.
сер 19 23:35:07 fedora systemd[1]: /etc/systemd/system/guix-daemon.service:12: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
сер 19 23:35:07 fedora systemd[1]: /etc/systemd/system/guix-daemon.service:13: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
According to the manual:
Guix includes an SELinux policy file at
etc/guix-daemon.cil
that can be installed on a system where SELinux is enabled, in order to label Guix files and to specify the expected behavior of the daemon…
The folks on the #guix
channel at Libera Chat helped me to figure out that the above instruction is for the manually compiled Guix from git. For Guix installed with the shell installer script, I had to look for the file in /gnu/store
:
$ find /gnu -name guix-daemon.cil
/gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/share/selinux/guix-daemon.cil
$ cd /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/share/selinux/
$ sudo semodule -i guix-daemon.cil
Now, the manual says:
Then relabel the file system with
restorecon
or by a different mechanism provided by your system.
I tried:
$ sudo restorecon -vR /gnu
This returns lots of
restorecon: Could not set context for /gnu/…: Read-only file system
For example:
$ find /gnu -name guix-daemon.service
/gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service
$ sudo restorecon -v /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service
restorecon: Could not set context for /gnu/store/0iii8i1lc4wg3wccs1db7y7d8lg80i04-guix-1.3.0/lib/systemd/system/guix-daemon.service: Read-only file system
And the daemon still cannot start.
My guess is that the issue is related to SELinux configuration or how Fedora handles it, but I do not understand it to be able to investigate it myself. Searching Guix issue tracker for "Read-only file system" "SELinux" returned just two issues which are not relevant.