git_daemon_selinux(8) git_daemon_selinux(8)
NAME
git_daemon_selinux - Security-Enhanced Linux policy for Git daemon.
DESCRIPTION
Security-Enhanced Linux provides security for Git daemon via flexible
mandatory access control.
FILE_CONTEXTS
SELinux requires files to have a files type. Files types may be speci-
fied system wide by the administrator with the semanage command and are
restored with the restorecon command. Users may use the chcon command
to change the files type of it's files. Policy governs the access
that Git daemon has to files.
Allow Git daemon to read the shared repository directory by adding the
git_daemon_system_content_t files type to the directory and by restor-
ing the files type.
semanage fcontext -a -t git_daemon_system_content_t "/srv/git(/.*)?"
restorecon -R -v /srv/git
Allow Git daemon to read the users personal repository directories by
adding the git_daemon_user_content_t files type to the directory and by
restoring the files type. This also requires the git_dae-
mon_enable_homedirs boolean is set to true.
semanage fcontext -a -t git_daemon_user_content_t "/home/*/pub-
lic_git(/.*)?"
restorecon -R -v /home/*/public_git
Allow Git daemon to read the user personal configuration file.
chcon -t git_daemon_user_content_t /home/joe/.gitconfig
BOOLEANS
SELinux policy is based on least privilege required and may also be
customizable by setting a boolean with setsebool.
Allow Git daemon to read users personal repository directories with the
git_daemon_user_content_t files type.
setsebool -P git_daemon_enable_homedirs on
Allow Git daemon to read the user personal configuration file.
chcon -t git_daemon_user_content_t /home/joe/.gitconfig
BOOLEANS
SELinux policy is based on least privilege required and may also be
customizable by setting a boolean with setsebool.
Allow Git daemon to read users personal repository directories with the
git_daemon_user_content_t files type.
setsebool -P git_daemon_enable_homedirs on
Allow Git daemon to use cifs for public file transfer services.
setsebool -P git_daemon_use_cifs on
Allow Git users to execute shared repositories.
setsebool -P allow_git_user_exec_content on
Allow Git daemon to use nfs for public file transfer services.
setsebool -P git_daemon_use_nfs on
ROLE
Allow Git daemon SELinux users to read, write and execute shared repos-
itories. This also requires the allow_git_user_exec_content boolean is
set to true.
semanage user -a -L s0 -r s0-s0 -R git_user_r -P user git_user_u
semanage login -a -s git_user_u joe
system-config-selinux is a GUI tool available to customize SELinux pol-
icy settings.
AUTHOR
This manual page was written by Dominick Grift <domg472@gmail.com>.
SEE ALSO
selinux(8), ftpd(8), setsebool(8), semanage(8), restorecon(8), chcon(8)
Git daemon SELinux policy documdomg472@gmail.com git_daemon_selinux(8)