GNU bug report logs - #44649
1.2.0rc0 tarball includes guix-daemon.cil.in

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 44649 in the body.
You can then email your comments to 44649 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Daniel Brooks <db48x <at> db48x.net>
To: bug-guix <at> gnu.org
Subject: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Sat, 14 Nov 2020 16:51:16 -0800

It should instead include the guix-daemon.cil file which was built from
it. The .in file has unsubstituted variabels in it which make it useless
as an SELinux policy.

Message #8 received at 44649 <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <marius <at> gnu.org>
To: Daniel Brooks <db48x <at> db48x.net>, 44649 <at> debbugs.gnu.org
Cc: Ludovic Courtès <ludo <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Sun, 15 Nov 2020 15:56:52 +0100

[Message part 1 (text/plain, inline)]

Daniel Brooks <db48x <at> db48x.net> writes:

> It should instead include the guix-daemon.cil file which was built from
> it. The .in file has unsubstituted variabels in it which make it useless
> as an SELinux policy.

Actually I think both should be included.  The processed file will work
for 99% of users, and the template is needed for the 1% that use a
different store directory.

@Ludo: WDYT about the attached patch for version-1.2.0?

[0001-maint-Install-the-processed-SELinux-policy-file-in-a.patch (text/x-patch, inline)]

From 8b77d853a4c9503df61fb75190d562206d1de1d2 Mon Sep 17 00:00:00 2001
From: Marius Bakke <marius <at> gnu.org>
Date: Sun, 15 Nov 2020 15:56:04 +0100
Subject: [PATCH] maint: Install the processed SELinux policy file in addition
 to the template.

This fixes <https://bugs.gnu.org/44649>.
Reported by Daniel Brooks <db48x <at> db48x.net>.

* Makefile.am (dist_selinux_policy_DATA): New target.
---
 Makefile.am | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index 5b84d74f08..4c061db3ca 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -561,8 +561,10 @@ dist_zshcompletion_DATA = etc/completion/zsh/_guix
 # Fish completion file.
 dist_fishcompletion_DATA = etc/completion/fish/guix.fish
 
-# SELinux policy
+# SELinux policy.  Install both the template and the compiled version so
+# it works "out of the box", but can be rebuilt as necessary.
 nodist_selinux_policy_DATA = etc/guix-daemon.cil.in
+dist_selinux_policy_DATA = etc/guix-daemon.cil
 
 EXTRA_DIST +=						\
   HACKING						\
-- 
2.29.2

[signature.asc (application/pgp-signature, inline)]

Message #11 received at 44649 <at> debbugs.gnu.org (full text, mbox):

From: Daniel Brooks <db48x <at> db48x.net>
To: Marius Bakke <marius <at> gnu.org>
Cc: Ludovic Courtès <ludo <at> gnu.org>, 44649 <at> debbugs.gnu.org
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Sun, 15 Nov 2020 07:08:52 -0800

Marius Bakke <marius <at> gnu.org> writes:

> Actually I think both should be included.  The processed file will work
> for 99% of users, and the template is needed for the 1% that use a
> different store directory.

Fair enough.

Message #14 received at 44649 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Daniel Brooks <db48x <at> db48x.net>
Cc: 44649 <at> debbugs.gnu.org, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Sun, 15 Nov 2020 21:19:03 +0100

Hi,

Daniel Brooks <db48x <at> db48x.net> skribis:

> It should instead include the guix-daemon.cil file which was built from
> it. The .in file has unsubstituted variabels in it which make it useless
> as an SELinux policy.

Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
your configuration.  What’s wrong with that?

Marius: common practice is to not include instantiated templates; we
wouldn’t use templates in the first place if contents were always the
same.  :-)

Thanks,
Ludo’.

Message #17 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: Daniel Brooks <db48x <at> db48x.net>
Cc: bug-guix <at> gnu.org, 44649 <at> debbugs.gnu.org, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Sun, 15 Nov 2020 22:02:22 +0100

[Message part 1 (text/plain, inline)]

Daniel Brooks 写道：
> Marius Bakke <marius <at> gnu.org> writes:
>
>> Actually I think both should be included.  The processed file 
>> will work
>> for 99% of users, and the template is needed for the 1% that 
>> use a
>> different store directory.
>
> Fair enough.

Is a pre-generated .cil file required to run ./configure at all on 
some systems?  How's it different from, say, the Makefile which is 
also generated later?

Kind regards,

T G-R

[signature.asc (application/pgp-signature, inline)]

Message #23 received at 44649 <at> debbugs.gnu.org (full text, mbox):

From: Daniel Brooks <db48x <at> db48x.net>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 44649 <at> debbugs.gnu.org, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Sun, 15 Nov 2020 13:24:27 -0800

Ludovic Courtès <ludo <at> gnu.org> writes:

> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
> your configuration.  What’s wrong with that?
>
> Marius: common practice is to not include instantiated templates; we
> wouldn’t use templates in the first place if contents were always the
> same.  :-)

That's true; I'd forgotten about that. The reason I mention it is that
it would be nice if guix-install.sh could set up the selinux policy. I
guess this is the only step that would need to run configure.

db48x

Message #28 received at 44649-done <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <marius <at> gnu.org>
To: Ludovic Courtès <ludo <at> gnu.org>, Daniel Brooks
 <db48x <at> db48x.net>
Cc: 44649-done <at> debbugs.gnu.org
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Sun, 15 Nov 2020 23:26:54 +0100

[Message part 1 (text/plain, inline)]

Ludovic Courtès <ludo <at> gnu.org> writes:

> Hi,
>
> Daniel Brooks <db48x <at> db48x.net> skribis:
>
>> It should instead include the guix-daemon.cil file which was built from
>> it. The .in file has unsubstituted variabels in it which make it useless
>> as an SELinux policy.
>
> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
> your configuration.  What’s wrong with that?
>
> Marius: common practice is to not include instantiated templates; we
> wouldn’t use templates in the first place if contents were always the
> same.  :-)

Yes indeed; somehow I thought the bootstrapped tarball also had run
"configure" with the common options, but obviously that's incorrect.

Closing this bug, as there is no reason to special-case this one file.

[signature.asc (application/pgp-signature, inline)]

Message #31 received at 44649 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Daniel Brooks <db48x <at> db48x.net>
Cc: 44649 <at> debbugs.gnu.org, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Mon, 16 Nov 2020 09:12:41 +0100

Hi Daniel,

Daniel Brooks <db48x <at> db48x.net> skribis:

> Ludovic Courtès <ludo <at> gnu.org> writes:
>
>> Yes, but running “./configure” gives you the ‘etc/guix-daemon.cil’ for
>> your configuration.  What’s wrong with that?
>>
>> Marius: common practice is to not include instantiated templates; we
>> wouldn’t use templates in the first place if contents were always the
>> same.  :-)
>
> That's true; I'd forgotten about that. The reason I mention it is that
> it would be nice if guix-install.sh could set up the selinux policy. I
> guess this is the only step that would need to run configure.

Good point!  The installed ‘guix’ has that file under
share/selinux/guix-daemon.cil, so perhaps the script could copy it from
there?

HTH,
Ludo’.

Message #34 received at 44649 <at> debbugs.gnu.org (full text, mbox):

From: Daniel Brooks <db48x <at> db48x.net>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 44649 <at> debbugs.gnu.org, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Mon, 16 Nov 2020 04:12:21 -0800

Ludovic Courtès <ludo <at> gnu.org> writes:

> Good point!  The installed ‘guix’ has that file under
> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
> there?

It only has it if you run configure first.

db48x

Message #37 received at 44649 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Daniel Brooks <db48x <at> db48x.net>
Cc: 44649 <at> debbugs.gnu.org, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Mon, 16 Nov 2020 13:53:56 +0100

Daniel Brooks <db48x <at> db48x.net> skribis:

> Ludovic Courtès <ludo <at> gnu.org> writes:
>
>> Good point!  The installed ‘guix’ has that file under
>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>> there?
>
> It only has it if you run configure first.

“The installed ‘guix’” here refers to the one
/var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.

HTH,
Ludo’.

Message #40 received at 44649 <at> debbugs.gnu.org (full text, mbox):

From: Daniel Brooks <db48x <at> db48x.net>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 44649 <at> debbugs.gnu.org, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Mon, 16 Nov 2020 05:15:20 -0800

Ludovic Courtès <ludo <at> gnu.org> writes:

>>> Good point!  The installed ‘guix’ has that file under
>>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>>> there?
>>
>> It only has it if you run configure first.
>
> “The installed ‘guix’” here refers to the one
> /var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.

It only has what's in the tarball, which is just guix-daemon.cil.in.

db48x

Message #43 received at 44649-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Daniel Brooks <db48x <at> db48x.net>
Cc: 44649-done <at> debbugs.gnu.org, Marius Bakke <marius <at> gnu.org>
Subject: Re: bug#44649: 1.2.0rc0 tarball includes guix-daemon.cil.in
Date: Mon, 16 Nov 2020 17:15:57 +0100

Daniel Brooks <db48x <at> db48x.net> skribis:

> Ludovic Courtès <ludo <at> gnu.org> writes:
>
>>>> Good point!  The installed ‘guix’ has that file under
>>>> share/selinux/guix-daemon.cil, so perhaps the script could copy it from
>>>> there?
>>>
>>> It only has it if you run configure first.
>>
>> “The installed ‘guix’” here refers to the one
>> /var/guix/profiles/per-user/root that ‘guix-install.sh’ installed.
>
> It only has what's in the tarball, which is just guix-daemon.cil.in.

Oh, got it; now that’s a bug, sorry if I had misunderstood all along!

Now fixed in d4031410375834349bc0d56630be86b076a1d704.

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.