From 587fd2dad49d8af3f31d06e29ff43c986d6f35c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9=20Lopez?= Date: Mon, 8 Dec 2025 16:39:11 +0100 Subject: etc: Add AppArmor profile for the daemon. * .gitignore: Add etc/apparmor.d/tunables/guix. * Makefile.am (nodist_apparmor_profile_DATA) (nodist_apparmor_profile_tunables_DATA): Define it. * configure.ac: Generate etc/apparmor.d/tunables/guix. Add --with-apparmor-profile-dir option. * etc/apparmor.d/guix-daemon: New file. * etc/apparmor.d/tunables/guix.in: New file. * doc/guix.texi: Document AppArmor profiles. * gnu/packages/package-management.scm (guix): Add future changes commented. Change-Id: Iac7df9d642383cc46a2d450c3badef31199ab041 Signed-off-by: Rutherther --- doc/guix.texi | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) (limited to 'doc') diff --git a/doc/guix.texi b/doc/guix.texi index d7d40ceb223..fc25b653f32 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -146,6 +146,7 @@ Copyright @copyright{} 2025 Artur Wroblewski@* Copyright @copyright{} 2025 Edouard Klein@* Copyright @copyright{} 2025 Rodion Goritskov@* Copyright @copyright{} 2025 dan@* +Copyright @copyright{} 2025 Noé Lopez@* Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or @@ -919,6 +920,7 @@ pre-built binaries. * Build Environment Setup:: Preparing the isolated build environment. * Daemon Offload Setup:: Offloading builds to remote machines. * SELinux Support:: Using an SELinux policy for the daemon. +* AppArmor Support:: Using an AppArmor profile for the daemon. @end menu @node Build Environment Setup @@ -1097,6 +1099,8 @@ systemctl daemon-reload systemctl start guix-daemon @end example +If your system has AppArmor enabled, @pxref{AppArmor Support}. + @quotation Warning The commands above assume that @command{guix pull} was run for the root user. You can check whether this is the case by running this command: @@ -1526,6 +1530,43 @@ installation time whenever the Guix package that provides the effectively running @code{guix-daemon} executable is upgraded. @end enumerate +@node AppArmor Support +@subsection AppArmor Support + +@cindex AppArmor + +Guix includes an AppArmor profile for the build daemon in +@file{etc/apparmor.d/guix-daemon} that can be installed on systems with +strict AppArmor policies to allow it to run unprivileged +(@pxref{Build Environment Setup}). Indeed, the unprivileged daemon makes +use of Linux user namespaces but these are disallowed +without an AppArmor policy on some systems like Ubuntu. + +To know if this applies to you, check if the +@code{kernel.apparmor_restrict_unprivileged_userns} kernel parameter is +enabled. + +@subsubsection Installing the AppArmor profile +@cindex AppArmor, profile installation + +@quotation Note +The @code{guix-install.sh} binary installation script offers to perform +the steps below for you (@pxref{Binary Installation}). +@end quotation + +Run these commands as root to install the profile: + +@example +export apparmor_sources=/var/guix/profiles/per-user/root/current-guix/etc/apparmor.d +cp -f -t /etc/apparmor.d/tunables "$apparmor_sources/tunables/guix" +cp -f -t /etc/apparmor.d "$apparmor_sources/guix-daemon" +cp -f -t /etc/apparmor.d "$apparmor_sources/guix" +apparmor_parser -r /etc/apparmor.d/guix-daemon +apparmor_parser -r /etc/apparmor.d/guix +@end example + +After this, the build daemon will be able to function correctly. + @node Invoking guix-daemon @section Invoking @command{guix-daemon} @cindex @command{guix-daemon} -- cgit v1.2.3