bug#66305: Error with recursive git checkout
Hi, I think I'm hitting this bug trying to git-fetch with submodules. I am on a foreign distro. --8<---cut here---start->8--- /gnu/store/pmv37cxc4cg1s7x8yg8dkhikkwmwpncr-git-minimal-2.41.0/libexec/git-core/git-submodule: line 7: /bin/basename: Permission denied /gnu/store/pmv37cxc4cg1s7x8yg8dkhikkwmwpncr-git-minimal-2.41.0/libexec/git-core/git-submodule: line 7: /bin/sed: Permission denied /gnu/store/pmv37cxc4cg1s7x8yg8dkhikkwmwpncr-git-minimal-2.41.0/libexec/git-core/git-sh-setup: line 77: /bin/basename: Permission denied /gnu/store/pmv37cxc4cg1s7x8yg8dkhikkwmwpncr-git-minimal-2.41.0/libexec/git-core/git-sh-setup: line 77: /bin/sed: Permission denied /gnu/store/pmv37cxc4cg1s7x8yg8dkhikkwmwpncr-git-minimal-2.41.0/libexec/git-core/git-sh-setup: line 292: /bin/uname: Permission denied /gnu/store/pmv37cxc4cg1s7x8yg8dkhikkwmwpncr-git-minimal-2.41.0/libexec/git-core/git-submodule: line 613: /bin/sed: Permission denied /gnu/store/pmv37cxc4cg1s7x8yg8dkhikkwmwpncr-git-minimal-2.41.0/libexec/git-core/git-submodule: line 613 : cmd_: command not found git-fetch: '/gnu/store/pmv37cxc4cg1s7x8yg8dkhikkwmwpncr-git-minimal-2.41.0/bin/git submodule update --init --recursive' failed with exit code 127 --8<---cut here---end--->8--- This is with a recent guix I think --8<---cut here---start->8--- ❯ guix describe Generation 8oct. 24 2023 21:31:58 (current) guix 0074731 repository URL: https://git.savannah.gnu.org/git/guix.git branch: master commit: 00747316ee0e1a7962ffe226c727776ba7a8163b --8<---cut here---end--->8--- Alexis
bug#66305: Error with recursive git checkout
ah well it seems this is due to a selinux policy error --8<---cut here---start->8--- SELinux is preventing git-submodule from execute access on the file /usr/bin/sed. * Plugin catchall (100. confidence) suggests ** If you believe that git-submodule should be allowed execute access on the sed file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'git-submodule' --raw | audit2allow -M my-gitsubmodule # semodule -X 300 -i my-gitsubmodule.pp Additional Information: Source Contextsystem_u:system_r:guix_daemon.guix_daemon_t:s0 Target Contextsystem_u:object_r:bin_t:s0 Target Objects/usr/bin/sed [ file ] Sourcegit-submodule Source Path git-submodule Port Host xps13 Source RPM Packages Target RPM Packages sed-4.8-12.fc38.x86_64 SELinux Policy RPMselinux-policy-targeted-38.29-1.fc38.noarch Local Policy RPM Selinux Enabled True Policy Type targeted Enforcing ModeEnforcing Host Name xps13 Platform Linux xps13 6.5.7-200.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Oct 11 04:07:58 UTC 2023 x86_64 Alert Count 460 First Seen2023-10-24 20:20:26 PDT Last Seen 2023-10-25 09:44:31 PDT Local ID fa57086c-6738-4eec-8252-3abb66a9e249 Raw Audit Messages type=AVC msg=audit(1698252271.150:513): avc: denied { execute } for pid=10644 comm="git-submodule" name="sed" dev="dm-0" ino=261979 scontext=system_u:system_r:guix_daemon.guix_daemon_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0 Hash: git-submodule,guix_daemon.guix_daemon_t,bin_t,file,execute --8<---cut here---end--->8--- But trying to fix it does not seem to have any effect. I've added this to the guix-daemon.cil and re-applied --8<---cut here---start->8--- (allow guix_daemon_t bin_t (file (execute))) --8<---cut here---end--->8--- Alexis
bug#66305: Error with recursive git checkout
This is what was needed in the selinux policy to fix the errors --8<---cut here---start->8--- (allow guix_daemon_t bin_t (file (execute execute_no_trans map))) --8<---cut here---end--->8--- Alexis
bug#70316: `guix pack -f squashfs` does not create /tmp and /var/tmp
Similarly to a previous patch for Docker [1], Singularity complains when using a squashfs image as the /tmp and /var/tmp folders do not exist. It would be great if they were, I had programs failing quietly because there was no /tmp folder and tracked down the issue to this. As a more general option, it could be interesting to have an option in guix pack to create any folder in the pack. Thanks, Alexis [1] https://issues.guix.gnu.org/issue/37161