nix upgrade-nix installation method breaks selinux context #486

New issue

Open

opened 2024-08-25 00:13:11 +00:00 by jade · 2 comments

jade commented

2024-08-25 00:13:11 +00:00

Owner

Migrated from: lix-project/lix-website#36

Original bug report by @libanp follows:

Distro: Bluefin (Fedora Linux 40.20240817.0 (Silverblue))
Original nix install method: Determinate systems installer

After I installed lix on with an existing nix install the nix-daemon would not run. The error from systemd was Unit nix-daemon.service could not be found.

This turned out to be an SELinux issue - the unit files no longer had the correct label. systemd could see the unit files after I ran sudo restorecon -Rv /nix/

Migrated from: https://git.lix.systems/lix-project/lix-website/issues/36 Original bug report by @libanp follows: Distro: Bluefin (Fedora Linux 40.20240817.0 (Silverblue)) Original nix install method: Determinate systems installer After I installed lix on with an existing nix install the nix-daemon would not run. The error from systemd was Unit nix-daemon.service could not be found. This turned out to be an SELinux issue - the unit files no longer had the correct label. systemd could see the unit files after I ran sudo restorecon -Rv /nix/

👍 2

jade referenced this issue from lix-project/lix-website

2024-08-25 00:13:50 +00:00

Install on existing system with SELinux breaks nix-daemon #36

jade added the

bug

Area/profiles

labels

2024-08-25 00:14:05 +00:00

jwillikers commented

2025-08-13 13:57:37 +00:00

Yeah, same issue on Fedora Atomic Sway and Fedora Kinoite. Really obtuse to figure out the actual cause of the issue. I hit this whenever upgrading Lix. Thanks @jade.

axelsimon commented

2025-11-19 12:54:54 +00:00

Same here, happy to see it already reported.

The selinux policy is still in place after the upgrade, eg:

sudo semanage fcontext --list | rg nix

/nix/store/[^/]+/etc(/.*)?                         all files          system_u:object_r:etc_t:s0 
/nix/store/[^/]+/lib(/.*)?                         all files          system_u:object_r:lib_t:s0 
/nix/store/[^/]+/lib/systemd/system(/.*)?          all files          system_u:object_r:systemd_unit_file_t:s0 
/nix/store/[^/]+/man(/.*)?                         all files          system_u:object_r:man_t:s0 
/nix/store/[^/]+/s?bin(/.*)?                       all files          system_u:object_r:bin_t:s0 
/nix/store/[^/]+/s?bin(/.*)?~                      all files          system_u:object_r:bin_t:s0 
/nix/store/[^/]+/share(/.*)?                       all files          system_u:object_r:usr_t:s0 
/nix/var/nix/daemon-socket(/.*)?                   all files          system_u:object_r:var_run_t:s0 
/nix/var/nix/profiles(/per-user/[^/]+)?/[^/]+      all files          system_u:object_r:usr_t:s0 
/run/\.iroha_unix                                  directory          system_u:object_r:canna_var_run_t:s0 
/run/\.iroha_unix/.*                               socket             system_u:object_r:canna_var_run_t:s0 
/run/collectd-unixsock                             socket             system_u:object_r:collectd_var_run_t:s0 
/run/ibacm-unix.*                                  socket             system_u:object_r:ibacm_var_run_t:s0 
/run/wnn-unix(/.*)                                 all files          system_u:object_r:canna_var_run_t:s0 
/tmp/\.ICE-unix(/.*)?                              all files          system_u:object_r:user_tmp_t:s0 
/tmp/\.X11-unix(/.*)?                              all files          system_u:object_r:user_tmp_t:s0 
/tmp/\.font-unix(/.*)?                             all files          system_u:object_r:user_fonts_t:s0 
/usr/bin/unix_chkpwd                               regular file       system_u:object_r:chkpwd_exec_t:s0 
/usr/bin/unix_update                               regular file       system_u:object_r:updpwd_exec_t:s0 
/usr/bin/unix_verify                               regular file       system_u:object_r:chkpwd_exec_t:s0 
/var/home/[^/]+/\.phoenix(/.*)?                    all files          unconfined_u:object_r:mozilla_home_t:s0

However after upgrading Lix, as reported above, the selinux labels get mangled, for instance:

eza -Z /etc/systemd/system
(…)
.rw-r--r-- 256 root unconfined_u:object_r:systemd_unit_file_t:s0     15 Sep 10:34 nix-directory.service
.rw-r--r-- 402 root unconfined_u:object_r:systemd_unit_file_t:s0     15 Sep 10:34 nix.mount

And similar on /nix/store/vr4a39d4bw01793jl4qap839rlvmc143-lix-2.94.0/bin/nix-daemon

Running the following commands to restore the selinux context from the existing policy fixed the upgraded install for me:

sudo restorecon -Rv /etc/systemd/system/
sudo restorecon -Rv /nix/store/
sudo systemctl daemon-reload for good measure

Relabeling the nix store took several minutes for me on a pretty powerful laptop, just to give people a heads up.

Same here, happy to see it already reported. The selinux policy is still in place after the upgrade, eg: ``` sudo semanage fcontext --list | rg nix /nix/store/[^/]+/etc(/.*)? all files system_u:object_r:etc_t:s0 /nix/store/[^/]+/lib(/.*)? all files system_u:object_r:lib_t:s0 /nix/store/[^/]+/lib/systemd/system(/.*)? all files system_u:object_r:systemd_unit_file_t:s0 /nix/store/[^/]+/man(/.*)? all files system_u:object_r:man_t:s0 /nix/store/[^/]+/s?bin(/.*)? all files system_u:object_r:bin_t:s0 /nix/store/[^/]+/s?bin(/.*)?~ all files system_u:object_r:bin_t:s0 /nix/store/[^/]+/share(/.*)? all files system_u:object_r:usr_t:s0 /nix/var/nix/daemon-socket(/.*)? all files system_u:object_r:var_run_t:s0 /nix/var/nix/profiles(/per-user/[^/]+)?/[^/]+ all files system_u:object_r:usr_t:s0 /run/\.iroha_unix directory system_u:object_r:canna_var_run_t:s0 /run/\.iroha_unix/.* socket system_u:object_r:canna_var_run_t:s0 /run/collectd-unixsock socket system_u:object_r:collectd_var_run_t:s0 /run/ibacm-unix.* socket system_u:object_r:ibacm_var_run_t:s0 /run/wnn-unix(/.*) all files system_u:object_r:canna_var_run_t:s0 /tmp/\.ICE-unix(/.*)? all files system_u:object_r:user_tmp_t:s0 /tmp/\.X11-unix(/.*)? all files system_u:object_r:user_tmp_t:s0 /tmp/\.font-unix(/.*)? all files system_u:object_r:user_fonts_t:s0 /usr/bin/unix_chkpwd regular file system_u:object_r:chkpwd_exec_t:s0 /usr/bin/unix_update regular file system_u:object_r:updpwd_exec_t:s0 /usr/bin/unix_verify regular file system_u:object_r:chkpwd_exec_t:s0 /var/home/[^/]+/\.phoenix(/.*)? all files unconfined_u:object_r:mozilla_home_t:s0 ``` However after upgrading Lix, as reported above, the selinux labels get mangled, for instance: ``` eza -Z /etc/systemd/system (…) .rw-r--r-- 256 root unconfined_u:object_r:systemd_unit_file_t:s0 15 Sep 10:34 nix-directory.service .rw-r--r-- 402 root unconfined_u:object_r:systemd_unit_file_t:s0 15 Sep 10:34 nix.mount ``` And similar on `/nix/store/vr4a39d4bw01793jl4qap839rlvmc143-lix-2.94.0/bin/nix-daemon` Running the following commands to restore the selinux context from the existing policy fixed the upgraded install for me: - `sudo restorecon -Rv /etc/systemd/system/` - `sudo restorecon -Rv /nix/store/` - `sudo systemctl daemon-reload` for good measure Relabeling the nix store took several minutes for me on a pretty powerful laptop, just to give people a heads up.