On 02/05/2010 04:53 PM, Michael Cronenworth wrote: > I am attempting to use gitweb to display git repos that live in /home > directories. The developers use ssh to push changes to their home > directory. It seems every Fedora release gitweb and SELinux have > changes. With Fedora 12, I cannot get SELinux to be happy about > accessing the git repos. > > Gitweb is pointing to: > /srv/git/ > Inside of that directory live symlinks to the git repos that live in > /home/user1/git > /home/user2/git > etc. > > I've attached the sealert output about the denial. I tried to assign a > context of httpd_git_content_ra_t to my git repo, but that did not allow > access. I realize this may not be "100%" secure, but this setup was > functioning in Fedoras 11 and under. I'd create a bug, but I'm not sure > if this setup would be considered a bug of SELinux. > Not really a bug but this access could be added. Although a revisited git policy is in rawhide (i do not know if it will also be pushed to f12) You can use audit2allow to permit this access. or manually write a module: cat mygitweb.te policy_module(mygitweb, 1.0.0) optional_policy(` gen_require(` type git_data_t, httpd_git_script_t; ') read_lnk_files_pattern(httpd_git_script_t, git_data_t, git_data_t) read_files_pattern(httpd_git_script_t, git_data_t, git_data_t) read_dirs_pattern(httpd_git_script_t, git_data_t, git_data_t) ') (build the module) make -f /usr/share/selinux/devel/Makefile mygitweb.pp (install the module) sudo semodule -i mygitweb.pp > Additional info: > $ ls -Z /var/www/git/ > -rw-r--r--. root root system_u:object_r:httpd_git_content_t:s0 > git-favicon.png > -rw-r--r--. root root system_u:object_r:httpd_git_content_t:s0 git-logo.png > -rwxr-xr-x. root root system_u:object_r:httpd_git_script_exec_t:s0 > gitweb.cgi > -rw-r--r--. root root system_u:object_r:httpd_git_content_t:s0 > gitweb_config.perl > -rw-r--r--. root root system_u:object_r:httpd_git_content_t:s0 gitweb.css > > Any ideas to allow access? > > Thanks, > Michael > > > > -- > selinux mailing list > selinux@xxxxxxxxxxxxxxxxxxxxxxx > https://admin.fedoraproject.org/mailman/listinfo/selinux
Attachment:
signature.asc
Description: OpenPGP digital signature
-- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
