guix/etc/guix-daemon.cil.in, branch sysadmin-team Transactional package manager, declarative GNU/Linux distribution, reproducible deployment tool, and more! https://guix.gnu.org etc: SELinux: Add permissions to allow garbage collection. 2025-12-15T20:53:21+00:00 Thiago Jung Bauermann bauermann@kolabnow.com 2025-12-08T04:35:05+00:00 53808b13b8c91826a0871bf49a9957b8228c4086 There may be an improvement to be made to guix-daemon to avoid some spurious denial audit messages, as described in the FIXME. * etc/guix-daemon.cil.in: Add missing rules for guix gc. Change-Id: I3651c4523528649048c7135fabd3000c8e78b1ff Signed-off-by: Rutherther <rutherther@ditigal.xyz> 
There may be an improvement to be made to guix-daemon to avoid some
spurious denial audit messages, as described in the FIXME.

* etc/guix-daemon.cil.in: Add missing rules for guix gc.

Change-Id: I3651c4523528649048c7135fabd3000c8e78b1ff
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
etc: SELinux: Add missing permissions. 2025-12-15T20:53:17+00:00 Thiago Jung Bauermann bauermann@kolabnow.com 2025-12-08T03:12:09+00:00 1b59b93602d034d75882b0ca076a732cd1865d98 With the changes in this commit, I can use "guix pull" and "guix install <package>" successfully and without generating SELinux denial erros in the system log. * etc/guix-daemon.cil.in: Add missing rules for guix pull/guix install. Change-Id: I40b5ed2c458b275804bc073fb72286947ecb0283 Signed-off-by: Rutherther <rutherther@ditigal.xyz> 
With the changes in this commit, I can use "guix pull" and
"guix install <package>" successfully and without generating SELinux
denial erros in the system log.

* etc/guix-daemon.cil.in: Add missing rules for guix pull/guix install.

Change-Id: I40b5ed2c458b275804bc073fb72286947ecb0283
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
etc: Update SELinux rule file to support unprivileged daemon. 2025-12-05T13:54:39+00:00 Rutherther rutherther@ditigal.xyz 2025-11-29T16:58:54+00:00 bd2edc9e435402b48fd201b56ab486151512717a Fixes: #3576. * etc/guix-daemon.cil.in: Add rules for unprivileged daemon. Change-Id: Ic0c561036230d397f7071daef33ca8181684d014 Signed-off-by: Ludovic Courtès <ludo@gnu.org> 
Fixes: #3576.

* etc/guix-daemon.cil.in: Add rules for unprivileged daemon.

Change-Id: Ic0c561036230d397f7071daef33ca8181684d014
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
etc: SELinux: Update policy file. 2023-05-25T10:51:15+00:00 Ludovic Courtès ludo@gnu.org 2023-05-25T09:37:35+00:00 3bf612eaa13cc39caab64567660b8a02d206d19a Tested on Rocky Linux 9, as discussed at <https://issues.guix.gnu.org/62487>. * etc/guix-daemon.cil.in: Add rules for /gnu/store remount and file creation in /tmp. 
Tested on Rocky Linux 9, as discussed
at <https://issues.guix.gnu.org/62487>.

* etc/guix-daemon.cil.in: Add rules for /gnu/store remount and file
creation in /tmp.
etc: SELinux: Allow init process to setattr on profile directories. 2022-12-23T19:20:06+00:00 Ricardo Wurmus rekado@elephly.net 2022-12-23T15:48:20+00:00 afaeb657b118e6998342110deab8c8110b824417 * etc/guix-daemon.cil.in: Add rule. 
* etc/guix-daemon.cil.in: Add rule.
etc: SELinux: Allow daemon to search run state directories. 2022-12-23T19:20:06+00:00 Ricardo Wurmus rekado@elephly.net 2022-12-23T15:47:11+00:00 4a134ed32e69ba888d988d2ed924a1531a54551b * etc/guix-daemon.cil.in: Import types init_var_run_t and system_dbusd_var_run_t; add rules. 
* etc/guix-daemon.cil.in: Import types init_var_run_t and
system_dbusd_var_run_t; add rules.
etc: SELinux: Label guix-daemon executable in profile. 2022-12-23T19:20:06+00:00 Ricardo Wurmus rekado@elephly.net 2022-12-23T15:44:58+00:00 f28d792719abb82cc920486e6d6f14eacc44370c * etc/guix-daemon.cil.in: Add file rule for "guix-daemon" in current-guix profile. 
* etc/guix-daemon.cil.in: Add file rule for "guix-daemon" in current-guix
profile.
etc: Remove redundant SELinux permissions block. 2022-01-26T08:31:45+00:00 Marius Bakke marius@gnu.org 2022-01-24T10:53:55+00:00 bbc2fb0d52128c85c92251ed36d8063b3dcf3c3a * etc/guix-daemon.cil.in (guix_daemon): Consolidate two blocks adding sock_file permissions on guix_daemon_conf_t. 
* etc/guix-daemon.cil.in (guix_daemon): Consolidate two blocks adding
sock_file permissions on guix_daemon_conf_t.
etc: Add more SELinux permissions for the daemon. 2022-01-24T10:28:14+00:00 Marius Bakke marius@gnu.org 2022-01-24T10:26:07+00:00 98e74d520a30d1ed7d7b47d4f1d9afadefc699e3 * etc/guix-daemon.cil.in (guix_daemon): Permit write on guix_daemon_conf_t sock_file, necessary for garbage collection. 
* etc/guix-daemon.cil.in (guix_daemon): Permit write on guix_daemon_conf_t
sock_file, necessary for garbage collection.
etc: Add more SELinux permissions for the daemon. 2021-05-22T17:53:17+00:00 Marius Bakke marius@gnu.org 2021-05-22T17:42:15+00:00 35bd94a49257bbadcb3ca25342e5c1ec33f438f0 * etc/guix-daemon.cil.in (guix_daemon): Add more permissions, necessary for garbage collection. 
* etc/guix-daemon.cil.in (guix_daemon): Add more permissions, necessary for
garbage collection.