mirror of
https://git.savannah.gnu.org/git/guix.git
synced 2026-04-06 21:20:33 +02:00
8ead7a9837
Currently Guix daemon would always fail to build packages that require execution of programs and scripts in "/tmp" directory (e.g. in "bootstrap" phase) on foreign distributions that use AppArmor as it denies such requests due to policy restrictions. This patch fixes "guix-daemon" AppArmor policy by allowing execution of programs in "/tmp" for "guix-builder". See <https://codeberg.org/guix/guix/issues/6501> * etc/apparmor.d/guix-daemon: Fix permissions for guix-daemon/guix-builder. Change-Id: Ib6a33fcc035011d7045da03346f3afeb598b7d7a Signed-off-by: Efraim Flashner <efraim@flashner.co.il>
89 lines
2.1 KiB
Plaintext
89 lines
2.1 KiB
Plaintext
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
include <tunables/guix>
|
|
|
|
profile guix-daemon @{guix_storedir}/*-{guix-daemon,guix}-*/bin/guix-daemon flags=(enforce,attach_disconnected.path=/disconnected) {
|
|
include <abstractions/base>
|
|
|
|
userns,
|
|
signal,
|
|
capability sys_admin,
|
|
capability net_admin,
|
|
capability sys_chroot,
|
|
capability setgid,
|
|
capability chown,
|
|
network dgram,
|
|
umount,
|
|
mount,
|
|
pivot_root,
|
|
# Paths inside build chroot
|
|
/real-root/ w,
|
|
/ w,
|
|
|
|
@{guix_localstatedir}/guix/** rwk,
|
|
/var/log/guix/** w,
|
|
owner @{PROC}/@{pid}/{fd/,environ} r,
|
|
owner @{PROC}/@{pid}/oom_score_adj w,
|
|
owner @{PROC}/@{pid}/uid_map rw,
|
|
owner @{PROC}/@{pid}/gid_map rw,
|
|
owner @{PROC}/@{pid}/setgroups w,
|
|
@{guix_storedir}/ r,
|
|
@{guix_storedir}/** rwlmk,
|
|
@{guix_storedir}/*/bin/guile cx -> guix-builder,
|
|
@{guix_storedir}/*-guix-command cx -> guix-helper,
|
|
@{guix_storedir}/*-guix-*/bin/guix cx -> guix-helper,
|
|
@{etc_rw}/nsswitch.conf r,
|
|
@{etc_rw}/passwd r,
|
|
@{etc_rw}/group r,
|
|
owner /tmp/** rwl,
|
|
owner /var/tmp/** rwl,
|
|
|
|
/usr/bin/newgidmap Ux,
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
include if exists <local/guix-daemon>
|
|
|
|
profile guix-builder flags=(enforce,attach_disconnected.path=/disconnected) {
|
|
include <abstractions/base>
|
|
|
|
signal (receive),
|
|
|
|
@{guix_storedir}/** rwlmkux,
|
|
|
|
owner /tmp/** rwux,
|
|
|
|
@{PROC}/@{pid}/fd/ r,
|
|
|
|
/disconnected/** rw,
|
|
}
|
|
|
|
# This is for any time guix is called by the daemon as a helper:
|
|
# - guix download
|
|
# - guix discover
|
|
# - guix gc --list-busy
|
|
# - probably more?
|
|
profile guix-helper flags=(enforce,attach_disconnected.path=/disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice>
|
|
|
|
signal (receive),
|
|
ptrace (read) peer=guix-daemon,
|
|
|
|
/disconnected/run/dbus/system_bus_socket rw,
|
|
dbus (send, receive),
|
|
@{guix_localstatedir}/guix/discover/ rw,
|
|
@{guix_localstatedir}/guix/discover/* rw,
|
|
|
|
@{guix_localstatedir}/guix/substitute/ rw,
|
|
@{guix_localstatedir}/guix/substitute/** rwk,
|
|
|
|
@{guix_sysconfdir}/guix/** r,
|
|
|
|
@{guix_storedir}/** rwlmix,
|
|
|
|
@{PROC}/ r,
|
|
owner @{PROC}/@{pid}/{fd/,environ} r,
|
|
}
|
|
}
|