Commit 83d4d159a0cd

@@ -79,7 +79,53 @@ clone_repo() {
 	git clone "$REPO_URL" "$REPO_PATH"
 }
 
-# --- Phase 3: System-manager ---
+# --- Phase 3: SELinux policy for Nix + systemd ---
+
+setup_selinux_policy() {
+	if ! command -v getenforce &>/dev/null || [[ "$(getenforce)" == "Disabled" ]]; then
+		log_info "SELinux not enforcing, skipping policy"
+		return 0
+	fi
+
+	if sudo semodule -l 2>/dev/null | grep -q nix-systemd; then
+		log_info "SELinux nix-systemd policy already installed"
+		return 0
+	fi
+
+	log_info "Installing SELinux policy for Nix + systemd integration..."
+
+	# Ensure build tools are available
+	sudo dnf install -y checkpolicy policycoreutils-python-utils
+
+	local tmpdir
+	tmpdir=$(mktemp -d)
+
+	cat > "${tmpdir}/nix-systemd.te" << 'POLICY'
+module nix-systemd 1.0;
+
+require {
+    type init_t;
+    type nix_store_t;
+    class file { read open getattr execute execute_no_trans map };
+    class dir { search getattr open read };
+    class lnk_file { read getattr };
+}
+
+# Allow systemd to follow symlinks into /nix/store for unit files
+allow init_t nix_store_t:dir { search getattr open read };
+allow init_t nix_store_t:file { read open getattr execute execute_no_trans map };
+allow init_t nix_store_t:lnk_file { read getattr };
+POLICY
+
+	checkmodule -M -m -o "${tmpdir}/nix-systemd.mod" "${tmpdir}/nix-systemd.te"
+	semodule_package -o "${tmpdir}/nix-systemd.pp" -m "${tmpdir}/nix-systemd.mod"
+	sudo semodule -i "${tmpdir}/nix-systemd.pp"
+
+	rm -rf "${tmpdir}"
+	log_info "SELinux policy installed"
+}
+
+# --- Phase 4: System-manager ---
 
 build_and_activate() {
 	log_info "Building system-manager config: $SYSTEM_CONFIG"
@@ -220,6 +266,7 @@ main() {
 	install_nix
 	configure_nix
 	clone_repo
+	setup_selinux_policy
 	build_and_activate
 	install_native_apps
 	setup_home_manager