From c0631fed5ddfed4826d7f48080963fc91c53e037 Mon Sep 17 00:00:00 2001
From: clime <clime@redhat.com>
Date: Wed, 3 Jan 2018 14:07:02 +0100
Subject: [PATCH] copr-dist-git: give map permission on git_user_content_t to
 cgit

---
 roles/copr/dist_git/files/git_script_t.pp | Bin 0 -> 963 bytes
 roles/copr/dist_git/files/git_script_t.te |   9 +++++++++
 roles/copr/dist_git/tasks/main.yml        |  12 ++++++++++++
 3 files changed, 21 insertions(+)
 create mode 100644 roles/copr/dist_git/files/git_script_t.pp
 create mode 100644 roles/copr/dist_git/files/git_script_t.te

diff --git a/roles/copr/dist_git/files/git_script_t.pp b/roles/copr/dist_git/files/git_script_t.pp
new file mode 100644
index 0000000000000000000000000000000000000000..c9e93ecbba293645698b9907e499184d52fd5359
GIT binary patch
literal 963
zcmb_b!D_-l5Ph~5dJwAp0>2>CKk(wsp8SBtrrVODNk}%(gTEktuP5c<J{YzM^x%VG
zHZyPM%_Ni4<!~MWpiKcBFNgCBfX!;YF3RqA{$71{JO2P+7HQA8VFKX02(HbWq7E)R
z0a#>j*<u+97Sb5Upq}Z8uVUvPqriS!D@`p?s*fL^2iMs0LubL}IRouAdT9`r$C<j;
zH!iQr;LG3wCly=Wq&M^yq&$SQ4xt#qx-{v?TfIIWCsW))wN=N$*8God%Hani(mKLW
roV}#A)ZfsZd&Tbs_RD4F;__^bTdQs5cTrB;_jkj@piloRo9n|BPhdW-

literal 0
HcmV?d00001

diff --git a/roles/copr/dist_git/files/git_script_t.te b/roles/copr/dist_git/files/git_script_t.te
new file mode 100644
index 0000000000..1c1f6cdbce
--- /dev/null
+++ b/roles/copr/dist_git/files/git_script_t.te
@@ -0,0 +1,9 @@
+module git_script_t 1.0.1;
+
+require {
+	type git_script_t;
+	type git_user_content_t;
+	class file { map };
+}
+
+allow git_script_t git_user_content_t:file map;
diff --git a/roles/copr/dist_git/tasks/main.yml b/roles/copr/dist_git/tasks/main.yml
index f22a6d0864..f773677d63 100644
--- a/roles/copr/dist_git/tasks/main.yml
+++ b/roles/copr/dist_git/tasks/main.yml
@@ -95,5 +95,17 @@
   - "dist-git.socket"
   - "copr-dist-git"
 
+- name: copy over our custom selinux policy for cgit
+  copy: src=git_script_t.pp dest=/usr/local/share/selinux/git_script_t.pp
+  register: cgit_selinux_module
+  tags:
+  - selinux
+
+- name: install our custom selinux policy for cgit
+  command: semodule -i /usr/local/share/selinux/git_script_t.pp
+  when: cgit_selinux_module|changed
+  tags:
+  - selinux
+
 - name: Create /var/cache/cgit/repo-list.rc if does not exists (it last 30 minutes to generate)
   command: /etc/cron.hourly/copr-dist-git creates=/var/cache/cgit/repo-list.rc