git_selinux(8)                                  Git SELinux policy documentation                                  git_selinux(8)



NAME
       git_selinux - Security Enhanced Linux Policy for the Git daemon.

DESCRIPTION
       Security-Enhanced Linux secures the Git server via flexible mandatory access control.

FILE_CONTEXTS
       SELinux  requires files to have an extended attribute to define the file type.  Policy governs the access daemons have to
       these files.  SELinux Git policy is very flexible allowing users to setup their web services in as  secure  a  method  as
       possible.

       The following file contexts types are by default defined for Git:
       git_system_content_t
       -  Set files with git_system_content_t if you want the Git system daemon to read the file, and if you want the file to be
       modifiable and executable by all "Git shell" users.
       git_session_content_t
       - Set files with git_session_content_t if you want the Git session and system daemon to read the file, and  if  you  want
       the file to be modifiable and executable by all users. Note that "Git shell" users may not interact with this type.

BOOLEANS
       SELinux  policy is customizable based on least access required. Git policy is extremely flexible and has several booleans
       that allow you to manipulate the policy and run Git with the tightest access possible.

       Allow the Git system daemon to search user home directories so that it can find git session content. This  is  useful  if
       you want the Git system daemon to host users personal repositories.
       sudo setsebool -P git_system_enable_homedirs 1

       Allow the Git system daemon to read system shared repositories on NFS shares.
       sudo setsebool -P git_system_use_nfs 1

       Allow the Git system daemon to read system shared repositories on Samba shares.
       sudo setsebool -P git_system_use_cifs 1

       Allow the Git session daemon to read users personal repositories on NFS mounted home directories.
       sudo setsebool -P use_nfs_home_dirs 1

       Allow the Git session daemon to read users personal repositories on Samba mounted home directories.
       sudo setsebool -P use_samba_home_dirs 1

       To  also  allow  Git system daemon to read users personal repositories on NFS and Samba mounted home directories you must
       also allow the Git system daemon to search home directories so that it can find the repositories.
       sudo setsebool -P git_system_enable_homedirs 1

       To allow the Git System daemon mass hosting of users personal repositories you can allow the Git daemon to listen to  any
       unreserved ports.
       sudo setsebool -P git_session_bind_all_unreserved_ports 1

GIT_SHELL
       The  Git  policy  by default provides a restricted user environment to be used with "Git shell". This default git_shell_u
       SELinux user can modify and execute generic Git system content (generic system shared respositories  with  type  git_sys-
       tem_content_t).

       To add a new Linux user and map him to this Git shell user domain automatically:
       sudo useradd -Z git_shell_u joe

ADVANCED_SYSTEM_SHARED_REPOSITORY_AND GIT_SHELL_RESTRICTIONS
       Alternatively  Git SELinux policy can be used to restrict "Git shell" users to git system shared repositories. The policy
       allows for the creation of new types of Git system content and Git shell user environment. The policy allows for  delega-
       tion of types of "Git shell" environments to types of Git system content.

       To add a new Git system repository type, for example "project1" create a file named project1.te and add to it:
       policy_module(project1, 1.0.0)
       git_content_template(project1)
       Next create a file named project1.fc and add a file context specification for the new repository type to it:
       /srv/git/project1.git(/.*)? gen_context(system_u:object_r:git_project1_content_t,s0)
       Build  a binary representation of this source policy module, load it into the policy store and restore the context of the
       repository:
       make -f /usr/share/selinux/devel/Makefile project.pp
       sudo semodule -i project1.pp
       sudo restorecon -R -v /srv/git/project1
       To create a "Git shell" domain that can interact with this repository create a file named  project1user.te  in  the  same
       directory as where the source policy for the Git systemm content type is and add the following:
       policy_module(project1user, 1.0.0)
       git_role_template(project1user)
       git_content_delegation(project1user_t, git_project1_content_t)
       gen_user(project1user_u, user, project1user_r, s0, s0)
       Build  a binary representation of this source policy module, load it into the policy store and map Linux users to the new
       project1user_u SELinux user:
       make -f /usr/share/selinux/devel/Makefile project1user.pp
       sudo semodule -i project1user.pp
       sudo useradd -Z project1user_u jane

       system-config-selinux is a GUI tool available to customize SELinux policy settings.

AUTHOR
       This manual page was written by Dominick Grift <domg472ATgmail.com>.

SEE ALSO
       selinux(8), git(8), chcon(1), semodule(8), setsebool(8)



domg472ATgmail.com                                          27 May 2010                                            git_selinux(8)