From 41cb84229e04fbead5f6d393417797be1c016ad5 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Thu, 26 Jan 2017 11:50:27 +0000
Subject: [PATCH] Fix selinux for Pagure

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
---
 roles/pagure/frontend/files/selinux/pagure.fc |   0
 roles/pagure/frontend/files/selinux/pagure.if |   1 +
 roles/pagure/frontend/files/selinux/pagure.pp | Bin 0 -> 7261 bytes
 roles/pagure/frontend/files/selinux/pagure.te |  11 +++++++++++
 roles/pagure/frontend/tasks/main.yml          |  16 ++++++++++++++--
 5 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 roles/pagure/frontend/files/selinux/pagure.fc
 create mode 100644 roles/pagure/frontend/files/selinux/pagure.if
 create mode 100644 roles/pagure/frontend/files/selinux/pagure.pp
 create mode 100644 roles/pagure/frontend/files/selinux/pagure.te

diff --git a/roles/pagure/frontend/files/selinux/pagure.fc b/roles/pagure/frontend/files/selinux/pagure.fc
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/roles/pagure/frontend/files/selinux/pagure.if b/roles/pagure/frontend/files/selinux/pagure.if
new file mode 100644
index 0000000000..3eb6a3057b
--- /dev/null
+++ b/roles/pagure/frontend/files/selinux/pagure.if
@@ -0,0 +1 @@
+## <summary></summary>
diff --git a/roles/pagure/frontend/files/selinux/pagure.pp b/roles/pagure/frontend/files/selinux/pagure.pp
new file mode 100644
index 0000000000000000000000000000000000000000..a6248e701434dd597c2e25737da4ff156ec5e338
GIT binary patch
literal 7261
zcmc&&OOM>R5mu7T1D!(<Aomo|mmWawwUa&hl-->*Vk90LnRPCUKwwLy7GsK3NU9%z
z|3Z-bs{ALP9DJnMt?ua=_lzB<fSH!WdhugbvB-bDfBWu7S(g1c%d+2OS@xeVvh1Jl
z-@f}*mSxx9(VwO6H}t|(y<)KZI?FP!|00X@vn<OxvFt7XB+IfV^T&S}2F3(I{DB1o
z1$a*Hm9#${Ue{K7{^h`Lxiu>;v}hUjASS9RynivMf?CMp4^&IV@Cm%7W#KuE2F(zI
zh?4pZ*zn$Ky#0J|z_AzJTgc-t*#()!-?{XK9Z&JL=S1W21OqU{bFu*%^DU(}PP$?x
zY@y_$@bE1$<M&vg@xH4HKaAW;$0|U{4-kC7Uow$?$G)B7gO2olOvzqyKk<BO8?gV|
zvEhNne&cy;H-+9qcoH4UCW1f5_J9HC_<QpEHeH|U`==tz4cJw3mm*kZ<PlOYEqVGy
z`lPghX!?$4q`{3)PYn14W<zL?KcAw1zkmB~I+@a?v|M^)x6}#m*=k3#O4^GF244v)
zTJ~(+)5(;c%&9W1ked9q<H?kMH>c8QFQjH0q@t#aH2(WJRXg=jW^xz7<X?E%D`5%P
zj9kL&r}8PNKEs_!aOis5E{u{Tq2`S|Qu<Bt`Mm-}v)B3p6~3ZZvSat<v**uVjvT9H
zZT|0`Ia9u2??!In%V&2BaDAgp`GzW9$&yK%Y8+Mz_4$2@VfAeztSCL(TRbZp``OWo
zo;^e6Aw3Fjg?7?Qqj&2V5JlLBu>#G-P&a0=HsqDG5Y9EP!*8jCb2D}q`45mo;QkGn
z9F6T&Jy=a}sn>Fos#A=;vCA-aCQYU^nbLLNb;f#XMQM$r+E{W3XH!!w&J?D_j)bnL
zW7|sSq|p(d?;Gi2m2r*fRYgXtEj41r2hvBfu#gNsBH!?KGNn@JC~diB%ep*N5gqu_
z*s%}u2+7w<jmj_l1lY;(-3owB8~tcssmE;d9p4prViKKZxV&o+R)%#MklSm%6kaT?
zXm2vm5GB{%@~QD*__gk=TuH@Cu8x$@j5np~D<&(}vdc-cM<LIt6R1!ZgBxd3jE)yK
zqv9|GLP);aM+JF9t?9K7%h2oi9AI=?=eZrBF&0DI^-k*LFe|VnOpf_N?+#Y1^tnO<
z-x%Ke+V~jRxJi7>q;4P$$WA~pEc+QaMo5nMgId$E6{v=ed?P%yrjqrRoEM(&n8W!B
z&BC!=@dq_J)>T+(B$Zrhq3(#E9kZ^;a>;T9QO$mBEc%(SPw$iQIIN=g*C9&juk`%Y
zx1k~=Ix}ykVV$mcJxY{NQK1Z3wQoaH_jyEMI_M2|E#WBw_hI99(61d5m{0Xo4mL);
z)DazuT@MY<VV`qIkhsx}I6CM;jtC+rTLni4Ey5AqYgw*4E~QYnEzN7kG_x$KP+7vI
zzy)~}Hw0dc2DmvOu>bHU-tM=VYqn^>(s~D*wd5*o+NXPs3ARAfcEZbrRMKyshKa)5
z*S$Bb@UncchRdxMtt?NN4s(E!m%d?3oi!ypHv(vw<^PuMwTORY)v+D=hlH|gWbO4#
z_ie7E^Yi&Uo}t2bv>1fXr2Ce<Y<a(0vep&XGv0JI_qOL^fhIbyg>u7lRMdV&m0?HP
z_}Jh0MvjU}QLwI*)Law+&Z=+QZS)aaqSTJ9CqbIm;F=Tlj;l~?CsSf;J1e!%$(i76
zsf<JSZdv<=(fpu2THq)ub;a6qMWwMghN|s-H}=UCJyvJbT39`6**UQsj-0^@5`+;H
z&tWh|$(a=99}TdzC-rO0*x00gPCINTQ)<N<CZV^!fd{pa>H!m6vMzeZc7}iG#B=H_
z*K(7SHHr(zKBrc>qT*Wg$}3*6ieIeIOU~(swsb`)JTHxv>{2IxCIt}S1g;Hu<7dNf
z4x5g{VPhrzHa}_ROe4`sDRjXbF4M6D&%GCmc#UwM^T1>pTwWNXW&yJSoMI(ZA0p&_
zo`v}f?`Bsqhbk_WupyWOtay5i^eAUnkDkP%(gREY&KoB77_%c6thiu>*3vhqq*4ow
zGEGvG)aax_|Ec?ytt`pdifv?ek4c#|JLG57(a2@P&WF4J-D|-BONci&yUJfgXyQB7
z*0h7SBWL$fIN&vV@j$q~5f1k|2zJ5>4+p;3^C+_p8y_Z@W_GWMjZX_}>C2G73-)Vf
zP0sYTWa@Ckg!3M{G-X7EKpnoK&+HYGi)YeM+wY{1WzUQyQH3@Ubw24puiCPXYjmfU
zy_()}j0VrP7A3nJ(P=ug!a}L-zK&b|M=vc?*ezmtq$X}mb+1bZ<m4nyvF%s1Hrf+!
zI?Op9v=MeS30$=?Nk;;kKis9+^y2A<0xHb=xeoKKd*55QoqSG5@kN-+4&sOlHohr&
zZaXDB$1JzKVi&XT44gi~?9Rs<cF&sd%V8Z-v@{}YxyuOuofKw$iTm9)0AACY6HZuk
z1kO<G08g(&REDxg!jVJY7<#zHHt_DE*jTJ1#LbGWl@$+C!+pqt!$yCui{EWL?#c)y
zn1yy^dXK9Z?3kO*a=3cI2`pT^Xyz)MxED;8amop|0wY$$S*Ul%tpu3oAFf;hx9<ly
SV)+i|!gJ@7L?d1YEB0Sjz`uk5

literal 0
HcmV?d00001

diff --git a/roles/pagure/frontend/files/selinux/pagure.te b/roles/pagure/frontend/files/selinux/pagure.te
new file mode 100644
index 0000000000..d661e611e9
--- /dev/null
+++ b/roles/pagure/frontend/files/selinux/pagure.te
@@ -0,0 +1,11 @@
+module pagure 1.0;
+
+require {
+        type httpd_t;
+	type gitosis_var_lib_t;
+	class dir { add_name remove_name write };
+	class file { create link setattr unlink write };
+}
+
+allow httpd_t gitosis_var_lib_t:dir { add_name remove_name write };
+allow httpd_t gitosis_var_lib_t:file { create link setattr unlink write };
diff --git a/roles/pagure/frontend/tasks/main.yml b/roles/pagure/frontend/tasks/main.yml
index b6c067cb69..d9ff9db476 100644
--- a/roles/pagure/frontend/tasks/main.yml
+++ b/roles/pagure/frontend/tasks/main.yml
@@ -261,8 +261,20 @@
   tags:
   - pagure
 
-- name: set sebooleans so pagure can talk to the db
-  seboolean: name=httpd_can_network_connect_db
+- name: copy over our custom selinux module
+  copy: src=selinux/pagure.pp dest=/usr/local/share/pagure.pp
+  register: selinux_module
+  tags:
+  - pagure
+
+- name: install our custom selinux module
+  command: semodule -i /usr/local/share/pagure.pp
+  when: selinux_module|changed
+  tags:
+  - pagure
+
+- name: set sebooleans so pagure can talk to the network (db + redis)
+  seboolean: name=httpd_can_network_connect
                     state=true
                     persistent=true
   tags: