Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

distgit: adjust the selinux policy a little more

Browse source 
Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
This commit is contained in:
Pierre-Yves Chibon 2020-11-10 16:48:30 +01:00
parent 1e27282806
commit 74890814a1
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
roles/distgit/files/http_policy.te
View file

@ -2,23 +2,27 @@ module http_policy 1.2;
require {
type gitosis_var_lib_t;
type httpd_suexec_t;
type httpd_sys_script_t;
type httpd_t;
type shadow_t;
type var_t;
type git_content_t;
class process setrlimit;
class capability { audit_write dac_read_search setgid setuid sys_resource };
class capability { audit_write dac_read_search net_admin setgid setuid sys_resource };
class netlink_audit_socket { create nlmsg_relay };
class file { create getattr link open read rename setattr unlink write };
class dir { add_name create getattr remove_name rmdir search write };
}
#============= httpd_suexec_t ==============
allow httpd_suexec_t httpd_sys_script_t:process { noatsecure rlimitinh siginh };
#============= httpd_sys_script_t ==============
allow httpd_sys_script_t git_content_t:dir search;
allow httpd_sys_script_t gitosis_var_lib_t:dir { getattr search };
allow httpd_sys_script_t self:capability { audit_write dac_read_search setgid setuid sys_resource };
allow httpd_sys_script_t self:netlink_audit_socket { create nlmsg_relay };
allow httpd_sys_script_t self:capability { audit_write dac_read_search net_admin setgid setuid sys_resource };
allow httpd_sys_script_t self:netlink_audit_socket { create nlmsg_relay read write };
allow httpd_sys_script_t self:process setrlimit;
allow httpd_sys_script_t shadow_t:file { getattr open read };
@ -29,5 +33,7 @@ allow httpd_t gitosis_var_lib_t:dir { create rmdir };
allow httpd_t gitosis_var_lib_t:dir { add_name remove_name write };
allow httpd_t gitosis_var_lib_t:file rename;
allow httpd_t gitosis_var_lib_t:file { create link unlink write };
allow httpd_t httpd_suexec_t:process { noatsecure rlimitinh siginh };
allow httpd_t self:capability net_admin;
allow httpd_t var_t:file { getattr open read };