summaryrefslogtreecommitdiff
path: root/etc/guix-daemon.cil.in
AgeCommit message (Collapse)AuthorFilesLines
2025-12-15etc: SELinux: Add permissions to allow garbage collection.Thiago Jung Bauermann1-0/+21
There may be an improvement to be made to guix-daemon to avoid some spurious denial audit messages, as described in the FIXME. * etc/guix-daemon.cil.in: Add missing rules for guix gc. Change-Id: I3651c4523528649048c7135fabd3000c8e78b1ff Signed-off-by: Rutherther <rutherther@ditigal.xyz>
2025-12-15etc: SELinux: Add missing permissions.Thiago Jung Bauermann1-2/+6
With the changes in this commit, I can use "guix pull" and "guix install <package>" successfully and without generating SELinux denial erros in the system log. * etc/guix-daemon.cil.in: Add missing rules for guix pull/guix install. Change-Id: I40b5ed2c458b275804bc073fb72286947ecb0283 Signed-off-by: Rutherther <rutherther@ditigal.xyz>
2025-12-05etc: Update SELinux rule file to support unprivileged daemon.Rutherther1-0/+11
Fixes: #3576. * etc/guix-daemon.cil.in: Add rules for unprivileged daemon. Change-Id: Ic0c561036230d397f7071daef33ca8181684d014 Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2023-05-25etc: SELinux: Update policy file.Ludovic Courtès1-0/+8
Tested on Rocky Linux 9, as discussed at <https://issues.guix.gnu.org/62487>. * etc/guix-daemon.cil.in: Add rules for /gnu/store remount and file creation in /tmp.
2022-12-23etc: SELinux: Allow init process to setattr on profile directories.Ricardo Wurmus1-0/+3
* etc/guix-daemon.cil.in: Add rule.
2022-12-23etc: SELinux: Allow daemon to search run state directories.Ricardo Wurmus1-3/+13
* etc/guix-daemon.cil.in: Import types init_var_run_t and system_dbusd_var_run_t; add rules.
2022-12-23etc: SELinux: Label guix-daemon executable in profile.Ricardo Wurmus1-0/+2
* etc/guix-daemon.cil.in: Add file rule for "guix-daemon" in current-guix profile.
2022-01-26etc: Remove redundant SELinux permissions block.Marius Bakke1-4/+1
* etc/guix-daemon.cil.in (guix_daemon): Consolidate two blocks adding sock_file permissions on guix_daemon_conf_t.
2022-01-24etc: Add more SELinux permissions for the daemon.Marius Bakke1-0/+3
* etc/guix-daemon.cil.in (guix_daemon): Permit write on guix_daemon_conf_t sock_file, necessary for garbage collection.
2021-05-22etc: Add more SELinux permissions for the daemon.Marius Bakke1-2/+5
* etc/guix-daemon.cil.in (guix_daemon): Add more permissions, necessary for garbage collection.
2020-12-10etc: Add more SELinux permissions for the daemon.Marius Bakke1-1/+3
* etc/guix-daemon.cil.in (guix_daemon): Permit file write, getattr, link and unlink for the guix_daemon_exec_t type.
2020-11-27etc: Add more SELinux permissions for the daemon.Marius Bakke1-5/+16
* etc/guix-daemon.cil.in (guix_daemon): Permit more operations required for various build jobs.
2020-11-26etc: Add more SELinux permissions for the daemon.Marius Bakke1-2/+13
* etc/guix-daemon.cil.in (guix_daemon): Permit file appending, setattr, read/write UDP sockets, access to tmpfs and hugetlbfs, and connecting to PostgreSQL.
2020-11-25etc: Add more SELinux permissions for the daemon.Marius Bakke1-0/+3
This is needed for some package test suites. * etc/guix-daemon.cil.in (guix_daemon): Permit unix_dgram_socket operations.
2020-11-15etc: Updates for the guix-daemon SELinux policy.Daniel Brooks1-18/+162
* etc/guix-daemon.cil.in (guix_daemon): Specify more permissions for guix-daemon to account for daemon updates and newer SELinux. I can't promise that this is a complete list of everything that guix-daemon needs, but it's probably most of them. It can search for, install, upgrade, and remove packages, create virtual machines and containers, update itself, and so on. Signed-off-by: Marius Bakke <marius@gnu.org>
2019-09-08etc: Remove references to libexec/guix* from SELinux policy.Ludovic Courtès1-4/+0
* etc/guix-daemon.cil.in: Remove references to libexec/guix*.
2018-02-07etc: Add SELinux policy for the daemon.Ricardo Wurmus1-0/+285
* etc/guix-daemon.cil.in: New file. * Makefile.am (dist_selinux_policy_DATA): Define it. * configure.ac: Handle --with-selinux-policy-dir. * doc/guix.texi (SELinux Support): New section.
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-03 05:49:11 +0000