~ruther/guix-local

ref: master guix-local/etc/apparmor.d/guix-daemon -rw-r--r-- 2.1 KiB
01b97dff — Hilton Chain import: crate: Generate comments with ‘TODO REVIEW:’ prefix. 2 months ago 
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

abi <abi/4.0>,

include <tunables/global>
include <tunables/guix>

profile guix-daemon @{guix_storedir}/*-{guix-daemon,guix}-*/bin/guix-daemon flags=(enforce,attach_disconnected.path=/disconnected) {
  include <abstractions/base>

  userns,
  signal,
  capability sys_admin,
  capability net_admin,
  capability sys_chroot,
  capability setgid,
  capability chown,
  network dgram,
  umount,
  mount,
  pivot_root,
  # Paths inside build chroot
  /real-root/ w,
  / w,

  @{guix_localstatedir}/guix/** rwk,
  /var/log/guix/** w,
  owner @{PROC}/@{pid}/{fd/,environ} r,
  owner @{PROC}/@{pid}/oom_score_adj w,
  owner @{PROC}/@{pid}/uid_map rw,
  owner @{PROC}/@{pid}/gid_map rw,
  owner @{PROC}/@{pid}/setgroups w,
  @{guix_storedir}/ r,
  @{guix_storedir}/** rwlmk,
  @{guix_storedir}/*/bin/guile cx -> guix-builder,
  @{guix_storedir}/*-guix-command cx -> guix-helper,
  @{guix_storedir}/*-guix-*/bin/guix cx -> guix-helper,
  @{etc_rw}/nsswitch.conf r,
  @{etc_rw}/passwd r,
  @{etc_rw}/group r,
  owner /tmp/** rwl,
  owner /var/tmp/** rwl,

  /usr/bin/newgidmap Ux,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/guix-daemon>

  profile guix-builder flags=(enforce,attach_disconnected.path=/disconnected) {
    include <abstractions/base>

    signal (receive),

    @{guix_storedir}/** rwlmkux,

    owner /tmp/** rw,

    @{PROC}/@{pid}/fd/ r,

    /disconnected/** rw,
  }

  # This is for any time guix is called by the daemon as a helper:
  # - guix download
  # - guix discover
  # - guix gc --list-busy
  # - probably more?
  profile guix-helper flags=(enforce,attach_disconnected.path=/disconnected) {
    include <abstractions/base>
    include <abstractions/nameservice>

    signal (receive),
    ptrace (read) peer=guix-daemon,

    /disconnected/run/dbus/system_bus_socket rw,
    dbus (send, receive),
    @{guix_localstatedir}/guix/discover/ rw,
    @{guix_localstatedir}/guix/discover/* rw,

    @{guix_localstatedir}/guix/substitute/ rw,
    @{guix_localstatedir}/guix/substitute/** rwk,

    @{guix_sysconfdir}/guix/** r,

    @{guix_storedir}/** rwlmix,

    @{PROC}/ r,
    owner @{PROC}/@{pid}/{fd/,environ} r,
  }
}