Re: Stuck installing guix package manager on Fedora with selinux

[Markku Korkeala]

Hi,

I haven't tried the official guix installation, but I was
able to get guix running on Fedora using rpm packages from copr:

https://copr.fedorainfracloud.org/coprs/lantw44/guix/

If you can't find solution to the SELinux problem, maybe
give those rpm packages a try.

Best regards,
Markku

On Tue, Oct 17, 2023 at 09:42:58AM -0700, Alexis Simon wrote:
> Hi,
> 
> I'd like to try the guix package manager but am stuck installing it on
> Fedora 38 with selinux. I should say I don't know anything about the details
> of either guix or selinux.
> I know a few other persons that also wanted to try guix but gave up due to
> issues with selinux, so I think solving this issue could help in adoption.
> 
> I've used the installer script which worked well, then was initially hit by
> this error
> `guix install: error: remounting /gnu/store writable: Permission denied`
> 
> This was solved by doing
> sudo semodule -i 
> /gnu/store/5kj8lyybjrdl7xd0fx9g9vzkz8sklqsy-guix-1.4.0/share/selinux/guix-daemon.cil
> 
> sudo mount -o remount,rw /gnu/store
> sudo restorecon -R /gnu /var/guix
> sudo systemctl restart guix-daemon.service
> 
> (note that the mount step was the missing part that was missing from all
> guides I've seen on the web, and I found it in a guix commit).
> 
> Now I have a different issue, guix-daemon doesn't seem to be able to access
> internet with errors of the type
> `In procedure getaddrinfo: Temporary failure in name resolution`
> (disabling selinux works in that case, but I want it enabled)
> 
> This is what I get from setroubleshoot:
> ```
> SELinux is preventing guix substitute from search access on the directory
> systemd.
> *****  Plugin catchall (100. confidence) suggests   *****
> *********************
> If you believe that guix substitute should be allowed sea
> rch access on the systemd directory by default.
> Then you should report this as a bug.
> You can generate a local policy module to allow this acce
> ss.
> Do
> allow this access for now by executing:
> # ausearch -c 'guix substitute' --raw | audit2allow -M my
> -guixsubstitute
> # semodule -X 300 -i my-guixsubstitute.pp
> ```
> 
> Trying the suggested commands also errors in:
> ```
> libsepol.hierarchy_add_type_callback: guix_daemon doesn't exist,
> guix_daemon.guix_daemon_t is an orphan
> libsepol.hierarchy_add_bounds: 1 errors found while adding hierarchies
> ```
> 
> So I don't really know where to go from there, any help appreciated.
> Thanks
> Alexis
>