Re: SELinux log

[Ricardo Wurmus]

Hi Laura,

> So we need to figure out what file that “guix” command corresponds to,
>> so that we can add a rule to the policy to apply the correct label.
>>
> I see. But how can we do this?

We then need to think about the kinds of file operations that the “guix”
command should be permitted to perform.  We know already that it should
be allowed to access files of type “guix_daemon_conf_t”.

What do you think: should we define a new type for the Guix command?  If
so, we need to declare it near the top:

  ;; Declare own types
  (type guix_daemon_t)
  …

We would add two new types: one is a file type “guix_client_exec_t”,
which will be given to the “guix” executables.  The file type should
allow the *process* spawned by the executable to operate in the
“guix_client_t” domain.

So, we’ll do this:

  (type guix_client_exec_t)
  (roletype object_r guix_client_exec_t)
  (type guix_client_t)
  (roletype object_r guix_client_t)

Since this type should not just be a file type but a *process* domain (=
a type for processes), we need to declare it as such, so this line

  (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))

would become that line:

  (typeattributeset domain (guix_daemon_t guix_daemon_exec_t guix_client_t))

Now we need to permit a domain transition: a file with type
guix_client_exec_t (when executed) should cause the resulting process to
transition to the guix_client_t domain.  I’m not sure about this, but I
think we want this transition declaration:

  (typetransition guix_store_content_t guix_client_exec_t
                  process guix_client_t)

This means: when a process in guix_store_content_t spawns a
guix_client_exec_t process, let it run in the guix_client_t context.

And *now* we can add rules of access for processes running in the
guix_client_t domain, such as these read-only directory access
permissions:

  (allow guix_client_t
         guix_daemon_conf_t
         (dir (search
               getattr
               open read)))

and perhaps these read-only file access permissions:

  (allow guix_client_t
         guix_daemon_conf_t
         (file (map
                getattr
                open read)))

Lastly, we need to add a file rule, so that the guix executables all get
the right type.  The first step is to see what “guix” is:

    readlink -f $(which guix)

It’s probably a store item with a particular name that isn’t captured by
an explicit rule in etc/guix-daemon.cil yet.  We then add a rule to give
the “guix” file the proper label, something like the following, but with
a glob pattern matching the actual “guix” file:

  (filecon "@storedir@/…/bin/guix"
           file (system_u object_r guix_client_exec_t (low low)))

Every time we change the policy we need to run semanage to unload the
loaded policy and load the new one from file, then run restorecon to
relabel (a subset of the) files in /gnu.

A little tedious, but it should be manageable.  Would you like to give
it a try?

--
Ricardo