selinux policy for git-daemon
- can pull from http://, ssh://, git://
* both from /srv/git/* and ~/joe/public_html/git/*
- can push to git+ssh://
* localusers(non shared push access) can only push to httpd user content in their home space
* gitusers(shared push access) can only push to /srv/git/ using git-shell
git-daemon for local-users: (~/public_html) (single push access)
* users with local access will be able to host git repositories as they would be personal home pages.
* user would mkdir ~/public_html, cd public_html, git clone ... repo, chcon -R -t httpd_user_home_content_t or restorecon (if semanage fcontext is set)
* http(pull only): git clone http://somesite.com/~joe/repo/.git repo1 (chmod +x /home/joe)
* git (pull only): git clone git://somesite.com/~joe/repo/.git repo3 (chmod +x /home/joe) also set user-dir to public_html/git instead of public_git in xinetd.d/git
* label ~/public_git httpd_user_home_content_t
* ssh (push and pull for userccount) git clone git+ssh://joe@somesite.com/home/joe/public_html/repo/.git repo2
* cannot push to shared repo in /srv/git/ (ofcourse can pull it)
* set boolean git_daemon_read_httpd_user_content!
git-daemon for git_users: (/srv/git/*) (shared push access)
* no bash-shell /home/dir, uses git_shell.
* can only manage/execute git_daemon_data_t. (/srv/git)
* shared reposities
* special userdomain with just push pull access
* http (pull only): git clone http://somesite.com/git/repo/.git repo5
* ssh (push and pull): must be in special git user domain to be able to push to shared repo. and to use pull with git+ssh://
* git (pull only): git clone git://somesite.com/repo/.git repo6