afaeb657b1
etc: SELinux: Allow init process to setattr on profile directories.
...
* etc/guix-daemon.cil.in: Add rule.
2022-12-23 20:20:06 +01:00
4a134ed32e
etc: SELinux: Allow daemon to search run state directories.
...
* etc/guix-daemon.cil.in: Import types init_var_run_t and
system_dbusd_var_run_t; add rules.
2022-12-23 20:20:06 +01:00
f28d792719
etc: SELinux: Label guix-daemon executable in profile.
...
* etc/guix-daemon.cil.in: Add file rule for "guix-daemon" in current-guix
profile.
2022-12-23 20:20:06 +01:00
bbc2fb0d52
etc: Remove redundant SELinux permissions block.
...
* etc/guix-daemon.cil.in (guix_daemon): Consolidate two blocks adding
sock_file permissions on guix_daemon_conf_t.
2022-01-26 09:31:45 +01:00
98e74d520a
etc: Add more SELinux permissions for the daemon.
...
* etc/guix-daemon.cil.in (guix_daemon): Permit write on guix_daemon_conf_t
sock_file, necessary for garbage collection.
2022-01-24 11:28:14 +01:00
35bd94a492
etc: Add more SELinux permissions for the daemon.
...
* etc/guix-daemon.cil.in (guix_daemon): Add more permissions, necessary for
garbage collection.
2021-05-22 19:53:17 +02:00
d677f3d623
etc: Add more SELinux permissions for the daemon.
...
* etc/guix-daemon.cil.in (guix_daemon): Permit file write, getattr, link and
unlink for the guix_daemon_exec_t type.
2020-12-10 23:48:42 +01:00
1807632393
etc: Add more SELinux permissions for the daemon.
...
* etc/guix-daemon.cil.in (guix_daemon): Permit more operations required for
various build jobs.
2020-11-27 21:33:59 +01:00
402ebffe19
etc: Add more SELinux permissions for the daemon.
...
* etc/guix-daemon.cil.in (guix_daemon): Permit file appending, setattr,
read/write UDP sockets, access to tmpfs and hugetlbfs, and connecting to
PostgreSQL.
2020-11-26 00:31:47 +01:00
d64e0261d0
etc: Add more SELinux permissions for the daemon.
...
This is needed for some package test suites.
* etc/guix-daemon.cil.in (guix_daemon): Permit unix_dgram_socket operations.
2020-11-25 23:24:52 +01:00
62343288ef
etc: Updates for the guix-daemon SELinux policy.
...
* etc/guix-daemon.cil.in (guix_daemon): Specify more permissions for
guix-daemon to account for daemon updates and newer SELinux.
I can't promise that this is a complete list of everything that guix-daemon
needs, but it's probably most of them. It can search for, install, upgrade,
and remove packages, create virtual machines and containers, update itself,
and so on.
Signed-off-by: Marius Bakke <marius@gnu.org>
2020-11-15 16:08:47 +01:00
cc98b00857
etc: Remove references to libexec/guix* from SELinux policy.
...
* etc/guix-daemon.cil.in: Remove references to libexec/guix*.
2019-09-08 11:49:25 +02:00
b617a9fe23
etc: Add SELinux policy for the daemon.
...
* etc/guix-daemon.cil.in: New file.
* Makefile.am (dist_selinux_policy_DATA): Define it.
* configure.ac: Handle --with-selinux-policy-dir.
* doc/guix.texi (SELinux Support): New section.
2018-02-07 15:41:23 +01:00
Ricardo Wurmus
Marius Bakke
Daniel Brooks
Ludovic Courtès
Ricardo Wurmus