git-daemon hosts personal and shared repositories.
personal repositories are by default located at ~/public_git.
the shared repository is by default located at /srv/git.
git_daemon resides in /bin/usr and can be started by local users and by xinetd.
confined local users usually may not bind sockets to ports. may consider application_domain later.
focus is on xinetd for now.
Personal repositories:
_____________________
chmod +x /home/joe
- apache requires access if you want to host pull access of your personal repository with httpd:// protocol (~UserDir)
- nobody(git-daemon) requires access if you want to host pull access of you personal repository with git:// protocol(--user-dir)
(system wide)
semanage fcontext -a -t httpd_user_content_t "/home/*/public_git(/.*)?"
restorecon -R -v /home/*/public_git
or
(user space)
chcon -R -t httpd_user_content_t /home/joe/public_git
if you want to host personal repositories with http then change public_html to public_git in httpd.conf or public_git to public_html/git in /etx/xinetd.d/git
enable UserDir in httpd.conf and enable --User-dir in /etc/xinetd.d/git. Refer to "man httpd_selinux" for details on apache selinux configuration.
for git-daemon to be able to push and pull to/from your personal repositories, git-daemon will need access to the httpd_user_content_t files type.
setsebool -P git_daemon_manage_httpd_user_content on
git clone git://mydomain.com/~joe/repo/.git test1
git clone httpd://mydomain.com/~joe/repo/.git test2
git clone git+ssh://joe@mydomain.com/home/joe/public_git/repo/.git test3
git push git+ssh://joe@mydomain.com/home/joe/public_git/repo/.git
Shared repository
_________________
The default shared repository location in in /srv/git/
local users only have read access to file types in /srv/git (git_daemon_data_t).
A local user cannot push to a local shared repository.
a shared repository can be read (pull) by the public.
git clone git://mydomain.com/repo/.git test4
git clone http//mydomain.com/repo/.git test5
to host pull access of a shared repository with httpd:// protocol you must configure httpd.conf properly.
to hust pull access of a shared repository with git:// protocol you must configure /etc/xinetd.d/git properly.
a shared repository can be read (pull) and written to (push) by "Git users"
A git user only has access to /usr/bin/git-shell. A git user does not have a home directory and cannot login using a regular ssh session.
With git-shell, git users can only push and pull from given repository.
The git-daemon domain provides interfaces that lets its callers have the required access to git_daemon_data_t files type.
Operators can create a very minimum git login user with access to git_daemon_data_t file_type.
DAC also provides attributes to further restrict access. Git users should be memmber of the git group.
git group should have read/write/execute acess to /srv/git
sh-3.2# ls -alZ /srv/git
drwxrwsr-x root root system_u:object_r:git_daemon_data_t .
drwxr-xr-x root root system_u:object_r:var_t ..
drwxrwsr-x domg472 git system_u:object_r:git_daemon_data_t trunk-r2767
Git users can push and can pull to share repositories.
git push git+ssh://joe@mydomain.com/srv/git/repo/.git
git clone git+ssh://joe@mydomain.com/srv/git/repo/.git test9