git_selinux(8)

1git_selinux(8)         Git SELinux policy documentation         git_selinux(8)
2
3
4

NAME

6       git_selinux - Security Enhanced Linux Policy for the Git daemon.
7

DESCRIPTION

9       Security-Enhanced  Linux  secures the Git server via flexible mandatory
10       access control.
11

FILE_CONTEXTS

13       SELinux requires files to have an extended attribute to define the file
14       type.   Policy governs the access daemons have to these files.  SELinux
15       Git policy is very flexible allowing users to setup their web  services
16       in as secure a method as possible.
17
18       The following file contexts types are by default defined for Git:
19       git_system_content_t
20       - Set files with git_system_content_t if you want the Git system daemon
21       to read the file, and if you want the file to be  modifiable  and  exe‐
22       cutable by all "Git shell" users.
23       git_session_content_t
24       -  Set files with git_session_content_t if you want the Git session and
25       system daemon to read the file, and if you want the file to be  modifi‐
26       able  and  executable by all users. Note that "Git shell" users may not
27       interact with this type.
28

BOOLEANS

30       SELinux policy is customizable based on least access required. Git pol‐
31       icy  is  extremely  flexible and has several booleans that allow you to
32       manipulate the policy and run Git with the tightest access possible.
33
34       Allow the Git system daemon to search user home directories so that  it
35       can find git session content. This is useful if you want the Git system
36       daemon to host users personal repositories.
37       sudo setsebool -P git_system_enable_homedirs 1
38
39       Allow the Git system daemon to read system shared repositories  on  NFS
40       shares.
41       sudo setsebool -P git_system_use_nfs 1
42
43       Allow the Git system daemon to read system shared repositories on Samba
44       shares.
45       sudo setsebool -P git_system_use_cifs 1
46
47       Allow the Git session daemon to read users personal repositories on NFS
48       mounted home directories.
49       sudo setsebool -P use_nfs_home_dirs 1
50
51       Allow  the  Git  session  daemon to read users personal repositories on
52       Samba mounted home directories.
53       sudo setsebool -P use_samba_home_dirs 1
54
55       To also allow Git system daemon to read users personal repositories  on
56       NFS and Samba mounted home directories you must also allow the Git sys‐
57       tem daemon to search home directories so that it can find the reposito‐
58       ries.
59       sudo setsebool -P git_system_enable_homedirs 1
60
61       To allow the Git System daemon mass hosting of users personal reposito‐
62       ries you can allow the Git daemon to listen to any unreserved ports.
63       sudo setsebool -P git_session_bind_all_unreserved_ports 1
64

GIT_SHELL

66       The Git policy by default provides a restricted user environment to  be
67       used with "Git shell". This default git_shell_u SELinux user can modify
68       and execute generic Git system content (generic system shared  resposi‐
69       tories with type git_system_content_t).
70
71       To add a new Linux user and map him to this Git shell user domain auto‐
72       matically:
73       sudo useradd -Z git_shell_u joe
74

ADVANCED_SYSTEM_SHARED_REPOSITORY_AND GIT_SHELL_RESTRICTIONS

76       Alternatively Git SELinux policy can be used to  restrict  "Git  shell"
77       users to git system shared repositories. The policy allows for the cre‐
78       ation of new types of Git system content and Git  shell  user  environ‐
79       ment. The policy allows for delegation of types of "Git shell" environ‐
80       ments to types of Git system content.
81
82       To add a new Git system repository type, for example "project1"  create
83       a file named project1.te and add to it:
84       policy_module(project1, 1.0.0)
85       git_content_template(project1)
86       Next  create a file named project1.fc and add a file context specifica‐
87       tion for the new repository type to it:
88       /srv/git/project1.git(/.*)? gen_context(system_u:object_r:git_project1_content_t,s0)
89       Build a binary representation of this source  policy  module,  load  it
90       into the policy store and restore the context of the repository:
91       make -f /usr/share/selinux/devel/Makefile project.pp
92       sudo semodule -i project1.pp
93       sudo restorecon -R -v /srv/git/project1
94       To  create  a "Git shell" domain that can interact with this repository
95       create a file named project1user.te in the same directory as where  the
96       source  policy  for the Git systemm content type is and add the follow‐
97       ing:
98       policy_module(project1user, 1.0.0)
99       git_role_template(project1user)
100       git_content_delegation(project1user_t, git_project1_content_t)
101       gen_user(project1user_u, user, project1user_r, s0, s0)
102       Build a binary representation of this source  policy  module,  load  it
103       into  the  policy  store  and map Linux users to the new project1user_u
104       SELinux user:
105       make -f /usr/share/selinux/devel/Makefile project1user.pp
106       sudo semodule -i project1user.pp
107       sudo useradd -Z project1user_u jane
108
109       system-config-selinux is a GUI tool available to customize SELinux pol‐
110       icy settings.
111

AUTHOR

113       This manual page was written by Dominick Grift <domg472@gmail.com>.
114