Bug 2416675
| Summary: | when nix home-manager enables systemd services: SELinux is preventing systemd from read access on the file /nix/store/.links/068hxxavszgi3zc7pp6vw1gm90ly5rrqm51j1b43103fxl7z2hbf | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dennis Schridde <heri> |
| Component: | nix | Assignee: | Jens Petersen <petersen> |
| Status: | ASSIGNED --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 43 | CC: | petersen, redhat, zbyszek |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Dennis Schridde
2025-11-23 20:41:25 UTC
P.S. The GPU access problem I am trying to fix affects Nix applications like `rio` or `gg-jj`. (Mentioning this, in case there is a way to fix the GPU access problem in the Fedora package, that is easier / safer than executing the `non-nixos-gpu` script Home Manager proposes to run.) I haven't actually tried any systemd services via nix. I wonder if this should go into fedora's selinux-policy? (In reply to Dennis Schridde from comment #0) > Their `nix.pp` is generated from > https://github.com/DeterminateSystems/nix-installer/blob/ > 91e0774401ea84ab8e0dcfdcfbc750ff7036435e/src/action/linux/selinux/nix.fc : > ``` > [...] > /nix/store/[^/]+/lib/systemd/system(/.*)? > system_u:object_r:systemd_unit_file_t:s0 > [...] > ``` > > However, `semodule -X 300 -i nix.pp` (where `nix.pp` is > https://github.com/DeterminateSystems/nix-installer/blob/ > 91e0774401ea84ab8e0dcfdcfbc750ff7036435e/src/action/linux/selinux/nix.pp) > followed by `sudo restorecon -rF /nix/store` did not allow me to run the > script, either (same SELinux violation). > > Following the instructions from my own system's logs and running `sudo > semanage fcontext -a -t systemd_unit_file_t > /nix/store/.links/068hxxavszgi3zc7pp6vw1gm90ly5rrqm51j1b43103fxl7z2hbf` > followed by `sudo restorecon -v > /nix/store/.links/068hxxavszgi3zc7pp6vw1gm90ly5rrqm51j1b43103fxl7z2hbf` > allows the script to succeed. P.S. I don't know enough about how SELinux work to explain why determinate.system's `nix.pp` did not work but my manual invocation of `semanage` did. Could this be because the rule is applied based on file name / path and the context is not attached to the inode? So `/nix/store/.links/068hxxavszgi3zc7pp6vw1gm90ly5rrqm51j1b43103fxl7z2hbf` being hardlinked as `/nix/store/n16vlkkvvi5ybvvhsq6wjiv3m4snwf27-non-nixos-gpu/resources/non-nixos-gpu.service`, and systemd for whatever reason trying to access it via the former name instead of the latter, would make SELinux see a different file context? Just curious, what happens if you try to use/do with the nix systemd package? (In reply to Jens Petersen from comment #4) > Just curious, what happens if you try to use/do with the nix systemd package? You mean replace Fedora's systemd installation with NixOS'? Is that even possible? I just mean from inside a nix shell say: e.g. inside `nix-shell -p systemd` or `nix shell nixpkgs#systemd` or you could even add systemd to your nix profile. May not help at all... specially with sudo: so perhaps it should be `sudo nix-shell ...`? Does not work: ``` ❯ sudo semanage fcontext -d /nix/store/.links/068hxxavszgi3zc7pp6vw1gm90ly5rrqm51j1b43103fxl7z2hbf ValueError: File context for /nix/store/.links/068hxxavszgi3zc7pp6vw1gm90ly5rrqm51j1b43103fxl7z2hbf is not defined ❯ sudo restorecon -v /nix/store/.links/068hxxavszgi3zc7pp6vw1gm90ly5rrqm51j1b43103fxl7z2hbf Relabeled /nix/store/.links/068hxxavszgi3zc7pp6vw1gm90ly5rrqm51j1b43103fxl7z2hbf from system_u:object_r:systemd_unit_file_t:s0 to system_u:object_r:default_t:s0 ❯ nix shell nixpkgs#systemd $ sudo /nix/store/n16vlkkvvi5ybvvhsq6wjiv3m4snwf27-non-nixos-gpu/bin/non-nixos-gpu-setup Failed to enable unit: Access denied ``` Okay, not surprised hm Any different with `sudo nix shell nixpkgs#systemd` ? Anyway I opened https://github.com/fedora-selinux/selinux-policy/issues/2963 (In reply to Jens Petersen from comment #8) > Any different with `sudo nix shell nixpkgs#systemd` ? No ``` ❯ sudo nix shell nixpkgs#systemd # ~REDACTED/.nix-profile/bin/non-nixos-gpu-setup Failed to enable unit: Access denied ``` (In reply to Jens Petersen from comment #9) > Anyway I opened https://github.com/fedora-selinux/selinux-policy/issues/2963 Thanks! I might be doing things wrongly, but installing the `nix.pp` SELinux module from nix-community/nix-installers or determinate.systems does not appear to solve my problem: ``` $ git clone git:nix-community/nix-installers.git $ cd nix-installers/selinux $ make $ sudo semodule -X 300 -i nix.pp $ sudo restorecon -rF /nix/store $ sudo ~REDACTED/.nix-profile/bin/non-nixos-gpu-setup Failed to enable unit: Access denied ``` `~REDACTED/.nix-profile/bin/non-nixos-gpu-setup` is the script installed via instructions from https://nix-community.github.io/home-manager/index.xhtml#sec-usage-gpu-non-nixos Could there be an additional step I'd have to take? Okay thanks for trying - I am don't really have any deep ideas. So it seems to give a different error message? Perhaps it is worth stepping back to see what if anything works at all? I think GPU enablement is a harder problem perhaps. Is it possible get any simple systemd units or service to work via /nix? I was trying to think of some such test-case. Not sure what else to test: does the setup work if you install nix with the indeterminant nix installer? You might get better help from the nix community perhaps. You could try booting a nixos live iso image too perhaps to compare? BTW different problem but for example I also cannot run EGL programs from toolbox: ⬢ fedora43~$ nix run nixpkgs/nixos-25.11#kitty [0.124] [glfw error 65542]: EGL: Failed to initialize EGL: An EGLDisplay argument does not name a valid EGL display connection display_present: 0 egl_platform_present: 0 Segmentation fault (core dumped) nix run nixpkgs/nixos-25.11#kitty (In reply to Jens Petersen from comment #13) > BTW different problem but for example I also cannot run EGL programs from > toolbox: > > ⬢ fedora43~$ nix run nixpkgs/nixos-25.11#kitty > [0.124] [glfw error 65542]: EGL: Failed to initialize EGL: An EGLDisplay > argument does not name a valid EGL display connection display_present: 0 > egl_platform_present: 0 > Segmentation fault (core dumped) nix run nixpkgs/nixos-25.11#kitty This looks a lot like the problem I tried to solve by following https://nix-community.github.io/home-manager/index.xhtml#sec-usage-gpu-non-nixos -- i.e. what originally brought me onto the path that eventually led me to create this issue report, see https://bugzilla.redhat.com/show_bug.cgi?id=2416675#c0 . (In reply to Jens Petersen from comment #13) > BTW different problem but for example I also cannot run EGL programs from > toolbox: > > ⬢ fedora43~$ nix run nixpkgs/nixos-25.11#kitty > [0.124] [glfw error 65542]: EGL: Failed to initialize EGL: An EGLDisplay > argument does not name a valid EGL display connection display_present: 0 > egl_platform_present: 0 > Segmentation fault (core dumped) nix run nixpkgs/nixos-25.11#kitty Also testing more: it seems unrelated to toolbox - I see same in a F43 VM. So probably happens without a gpu too. (Of course we have kitty in fedora) Did you try to "setenforce 0" btw? No, never tried that, because `sudo semanage fcontext -d /nix/store/.links/...` followed by `sudo restorecon -v /nix/store/.links/...` allows the script to execute successfully. So it seems related to SELinux (which I assume `setenforce 0` would confirm, right?), particularly the policy for a specific file. |