| 1 | abi <abi/4.0>, |
| 2 | |
| 3 | include <tunables/global> |
| 4 | include <tunables/guix> |
| 5 | |
| 6 | profile guix-daemon @{guix_storedir}/*-{guix-daemon,guix}-*/bin/guix-daemon flags=(enforce,attach_disconnected.path=/disconnected) { |
| 7 | include <abstractions/base> |
| 8 | |
| 9 | userns, |
| 10 | signal, |
| 11 | capability sys_admin, |
| 12 | capability net_admin, |
| 13 | capability sys_chroot, |
| 14 | capability setgid, |
| 15 | capability chown, |
| 16 | network dgram, |
| 17 | umount, |
| 18 | mount, |
| 19 | pivot_root, |
| 20 | # Paths inside build chroot |
| 21 | /real-root/ w, |
| 22 | / w, |
| 23 | |
| 24 | @{guix_localstatedir}/guix/** rwk, |
| 25 | /var/log/guix/** w, |
| 26 | owner @{PROC}/@{pid}/{fd/,environ} r, |
| 27 | owner @{PROC}/@{pid}/oom_score_adj w, |
| 28 | owner @{PROC}/@{pid}/uid_map rw, |
| 29 | owner @{PROC}/@{pid}/gid_map rw, |
| 30 | owner @{PROC}/@{pid}/setgroups w, |
| 31 | @{guix_storedir}/ r, |
| 32 | @{guix_storedir}/** rwlmk, |
| 33 | @{guix_storedir}/*/bin/guile cx -> guix-builder, |
| 34 | @{guix_storedir}/*-guix-command cx -> guix-helper, |
| 35 | @{guix_storedir}/*-guix-*/bin/guix cx -> guix-helper, |
| 36 | @{etc_rw}/nsswitch.conf r, |
| 37 | @{etc_rw}/passwd r, |
| 38 | @{etc_rw}/group r, |
| 39 | owner /tmp/** rwl, |
| 40 | owner /var/tmp/** rwl, |
| 41 | |
| 42 | /usr/bin/newgidmap Ux, |
| 43 | |
| 44 | # Site-specific additions and overrides. See local/README for details. |
| 45 | include if exists <local/guix-daemon> |
| 46 | |
| 47 | profile guix-builder flags=(enforce,attach_disconnected.path=/disconnected) { |
| 48 | include <abstractions/base> |
| 49 | |
| 50 | signal (receive), |
| 51 | |
| 52 | @{guix_storedir}/** rwlmkux, |
| 53 | |
| 54 | owner /tmp/** rwklmux, |
| 55 | |
| 56 | @{PROC}/@{pid}/fd/ r, |
| 57 | |
| 58 | /disconnected/** rw, |
| 59 | } |
| 60 | |
| 61 | # This is for any time guix is called by the daemon as a helper: |
| 62 | # - guix download |
| 63 | # - guix discover |
| 64 | # - guix gc --list-busy |
| 65 | # - probably more? |
| 66 | profile guix-helper flags=(enforce,attach_disconnected.path=/disconnected) { |
| 67 | include <abstractions/base> |
| 68 | include <abstractions/nameservice> |
| 69 | |
| 70 | signal (receive), |
| 71 | ptrace (read) peer=guix-daemon, |
| 72 | |
| 73 | /disconnected/run/dbus/system_bus_socket rw, |
| 74 | dbus (send, receive), |
| 75 | @{guix_localstatedir}/guix/discover/ rw, |
| 76 | @{guix_localstatedir}/guix/discover/* rw, |
| 77 | |
| 78 | @{guix_localstatedir}/guix/substitute/ rw, |
| 79 | @{guix_localstatedir}/guix/substitute/** rwk, |
| 80 | |
| 81 | @{guix_sysconfdir}/guix/** r, |
| 82 | |
| 83 | @{guix_storedir}/** rwlmix, |
| 84 | |
| 85 | @{PROC}/ r, |
| 86 | owner @{PROC}/@{pid}/{fd/,environ} r, |
| 87 | } |
| 88 | } |