git_selinux - Security Enhanced Linux Policy for the Git daemon.

       Alternatively Git SELinux policy can be  used  to  restrict  "Git  shell"  users  to  git  system  shared
       repositories.  The  policy  allows for the creation of new types of Git system content and Git shell user
       environment. The policy allows for delegation of types of "Git shell" environments to types of Git system
       content.

       To add a new Git system repository type, for example "project1" create a file named project1.te  and  add
       to it:
       policy_module(project1, 1.0.0)
       git_content_template(project1)
       Next  create a file named project1.fc and add a file context specification for the new repository type to
       it:
       /srv/git/project1.git(/.*)? gen_context(system_u:object_r:git_project1_content_t,s0)
       Build a binary representation of this source policy module, load it into the policy store and restore the
       context of the repository:
       make -f /usr/share/selinux/devel/Makefile project.pp
       sudo semodule -i project1.pp
       sudo restorecon -R -v /srv/git/project1
       To create a "Git shell" domain that can interact with this repository create a file named project1user.te
       in the same directory as where the source policy for  the  Git  systemm  content  type  is  and  add  the
       following:
       policy_module(project1user, 1.0.0)
       git_role_template(project1user)
       git_content_delegation(project1user_t, git_project1_content_t)
       gen_user(project1user_u, user, project1user_r, s0, s0)
       Build  a  binary representation of this source policy module, load it into the policy store and map Linux
       users to the new project1user_u SELinux user:
       make -f /usr/share/selinux/devel/Makefile project1user.pp
       sudo semodule -i project1user.pp
       sudo useradd -Z project1user_u jane

       system-config-selinux is a GUI tool available to customize SELinux policy settings.

       This manual page was written by Dominick Grift <domg472@gmail.com>.

       SELinux  policy  is customizable based on least access required. Git policy is extremely flexible and has
       several booleans that allow you to manipulate the policy and run Git with the tightest access possible.

       Allow the Git system daemon to search user home directories so that it can find git session content. This
       is useful if you want the Git system daemon to host users personal repositories.
       sudo setsebool -P git_system_enable_homedirs 1

       Allow the Git system daemon to read system shared repositories on NFS shares.
       sudo setsebool -P git_system_use_nfs 1

       Allow the Git system daemon to read system shared repositories on Samba shares.
       sudo setsebool -P git_system_use_cifs 1

       Allow the Git session daemon to read users personal repositories on NFS mounted home directories.
       sudo setsebool -P use_nfs_home_dirs 1

       Allow the Git session daemon to read users personal repositories on Samba mounted home directories.
       sudo setsebool -P use_samba_home_dirs 1

       To also allow Git system daemon to read users  personal  repositories  on  NFS  and  Samba  mounted  home
       directories  you must also allow the Git system daemon to search home directories so that it can find the
       repositories.
       sudo setsebool -P git_system_enable_homedirs 1

       To allow the Git System daemon mass hosting of users personal repositories you can allow the  Git  daemon
       to listen to any unreserved ports.
       sudo setsebool -P git_session_bind_all_unreserved_ports 1

       Security-Enhanced Linux secures the Git server via flexible mandatory access control.

       SELinux  requires files to have an extended attribute to define the file type.  Policy governs the access
       daemons have to these files.  SELinux Git policy is very flexible  allowing  users  to  setup  their  web
       services in as secure a method as possible.

       The following file contexts types are by default defined for Git:
       git_system_content_t
       - Set files with git_system_content_t if you want the Git system daemon to read the file, and if you want
       the file to be modifiable and executable by all "Git shell" users.
       git_session_content_t
       -  Set  files  with git_session_content_t if you want the Git session and system daemon to read the file,
       and if you want the file to be modifiable and executable by all users. Note that "Git  shell"  users  may
       not interact with this type.

       The  Git  policy  by  default  provides  a  restricted user environment to be used with "Git shell". This
       default git_shell_u SELinux user can modify and execute generic Git system content (generic system shared
       repositories with type git_system_content_t).

       To add a new Linux user and map him to this Git shell user domain automatically:
       sudo useradd -Z git_shell_u joe

       git_selinux - Security Enhanced Linux Policy for the Git daemon.

selinux(8), git(8), chcon(1), semodule(8), setsebool(8)

domg472@gmail.com                                  27 May 2010                                    git_selinux(8)