git_selinux(8) Git SELinux policy documentation git_selinux(8)NAMEgit_selinux - Security Enhanced Linux Policy for the Git daemon.
DESCRIPTION
Security-Enhanced Linux secures the Git server via flexible mandatory
access control.
FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file
type. Policy governs the access daemons have to these files. SELinux
Git policy is very flexible allowing users to setup their web services
in as secure a method as possible.
The following file contexts types are by default defined for Git:
git_system_content_t
- Set files with git_system_content_t if you want the Git system daemon
to read the file, and if you want the file to be modifiable and exe‐
cutable by all "Git shell" users.
git_session_content_t
- Set files with git_session_content_t if you want the Git session and
system daemon to read the file, and if you want the file to be modifi‐
able and executable by all users. Note that "Git shell" users may not
interact with this type.
BOOLEANS
SELinux policy is customizable based on least access required. Git pol‐
icy is extremely flexible and has several booleans that allow you to
manipulate the policy and run Git with the tightest access possible.
Allow the Git system daemon to search user home directories so that it
can find git session content. This is useful if you want the Git system
daemon to host users personal repositories.
sudo setsebool -P git_system_enable_homedirs 1
Allow the Git system daemon to read system shared repositories on NFS
shares.
sudo setsebool -P git_system_use_nfs 1
Allow the Git system daemon to read system shared repositories on Samba
shares.
sudo setsebool -P git_system_use_cifs 1
Allow the Git session daemon to read users personal repositories on NFS
mounted home directories.
sudo setsebool -P use_nfs_home_dirs 1
Allow the Git session daemon to read users personal repositories on
Samba mounted home directories.
sudo setsebool -P use_samba_home_dirs 1
To also allow Git system daemon to read users personal repositories on
NFS and Samba mounted home directories you must also allow the Git sys‐
tem daemon to search home directories so that it can find the reposito‐
ries.
sudo setsebool -P git_system_enable_homedirs 1
To allow the Git System daemon mass hosting of users personal reposito‐
ries you can allow the Git daemon to listen to any unreserved ports.
sudo setsebool -P git_session_bind_all_unreserved_ports 1
GIT_SHELL
The Git policy by default provides a restricted user environment to be
used with "Git shell". This default git_shell_u SELinux user can modify
and execute generic Git system content (generic system shared resposi‐
tories with type git_system_content_t).
To add a new Linux user and map him to this Git shell user domain auto‐
matically:
sudo useradd -Z git_shell_u joe
ADVANCED_SYSTEM_SHARED_REPOSITORY_AND GIT_SHELL_RESTRICTIONS
Alternatively Git SELinux policy can be used to restrict "Git shell"
users to git system shared repositories. The policy allows for the cre‐
ation of new types of Git system content and Git shell user environ‐
ment. The policy allows for delegation of types of "Git shell" environ‐
ments to types of Git system content.
To add a new Git system repository type, for example "project1" create
a file named project1.te and add to it:
policy_module(project1, 1.0.0)
git_content_template(project1)
Next create a file named project1.fc and add a file context specifica‐
tion for the new repository type to it:
/srv/git/project1.git(/.*)? gen_context(system_u:object_r:git_project1_content_t,s0)
Build a binary representation of this source policy module, load it
into the policy store and restore the context of the repository:
make -f /usr/share/selinux/devel/Makefile project.pp
sudo semodule -i project1.pp
sudo restorecon -R -v /srv/git/project1
To create a "Git shell" domain that can interact with this repository
create a file named project1user.te in the same directory as where the
source policy for the Git systemm content type is and add the follow‐
ing:
policy_module(project1user, 1.0.0)
git_role_template(project1user)
git_content_delegation(project1user_t, git_project1_content_t)
gen_user(project1user_u, user, project1user_r, s0, s0)
Build a binary representation of this source policy module, load it
into the policy store and map Linux users to the new project1user_u
SELinux user:
make -f /usr/share/selinux/devel/Makefile project1user.pp
sudo semodule -i project1user.pp
sudo useradd -Z project1user_u jane
system-config-selinux is a GUI tool available to customize SELinux pol‐
icy settings.
AUTHOR
This manual page was written by Dominick Grift <domg472@gmail.com>.
SEE ALSOselinux(8), git(8), chcon(1), semodule(8), setsebool(8)domg472@gmail.com 27 May 2010 git_selinux(8)
