On четверг, 20 июня 2019 г. 18:27:31 MSK, Dominick Grift wrote:
On Thu, Jun 20, 2019 at 06:05:57PM +0300, Alexander Miroshnichenko wrote:
On четверг, 20 июня 2019 г. 17:50:11 MSK, Dominick Grift wrote: ...
Yes this sucks. I would probably do the following instead:
1. echo "ignoredirs=/var/lib/gitolite" >> /etc/selinux/semanage.conf
2. semodule -B && restorecon -RvF /var/lib/gitolite
3. gitosis_read_lib_files(sshd_t)
I can't use sshd_t in another policy without require statement.
Or I need to add gitosis_read_lib_files(sshd_t) to ssh.te policy file.
All 3 steps are ugly comparing with new ssh_search_dir() interface.
Why such restrictions where caller must be the source for interface? It is
not flexible.
Dont bother with labeling /var/lib/gitolite/.ssh differently
...
