git_daemon_selinux(8)                                    git_daemon_selinux(8)



NAME
       git_daemon_selinux - Security-Enhanced Linux policy for Git daemon.

DESCRIPTION
       Security-Enhanced  Linux  provides security for Git daemon via flexible
       mandatory access control.

FILE_CONTEXTS
       SELinux requires files to have a files type. Files types may be  speci-
       fied system wide by the administrator with the semanage command and are
       restored with the restorecon command. Users may use the  chcon  command
       to  change  the  files  type of it's files.   Policy governs the access
       that Git daemon has to files.

       Allow Git daemon to read the shared repository directory by adding  the
       git_daemon_system_content_t  files type to the directory and by restor-
       ing the files type.

       semanage fcontext -a -t git_daemon_system_content_t "/srv/git(/.*)?"

       restorecon -R -v /srv/git

       Allow Git daemon to read the users personal repository  directories  by
       adding the git_daemon_user_content_t files type to the directory and by
       restoring  the  files  type.    This   also   requires   the   git_dae-
       mon_enable_homedirs boolean is set to true.

       semanage  fcontext  -a   -t   git_daemon_user_content_t   "/home/*/pub-
       lic_git(/.*)?"

       restorecon -R -v /home/*/public_git

       Allow Git daemon to read the user personal configuration file.

       chcon -t git_daemon_user_content_t /home/joe/.gitconfig

BOOLEANS
       SELinux  policy  is  based  on least privilege required and may also be
       customizable by setting a boolean with the setsebool command.

       Allow Git daemon to read users personal repository directories with the
       git_daemon_user_content_t files type.

       setsebool -P git_daemon_enable_homedirs on

       Allow Git daemon to use cifs for public file transfer services.

       setsebool -P git_daemon_use_cifs on

       Allow Git daemon to use nfs for public file transfer services.

       setsebool -P git_daemon_use_nfs on

ROLE
       Allow Git daemon SELinux users to read, write and execute shared repos-
       itories.

       semanage user -a -L s0 -r s0-s0 -R git_user_r -P user git_user_u

       semanage login -a -s git_user_u joe

       system-config-selinux is a GUI tool available to customize SELinux pol-
       icy settings.

AUTHOR
       This manual page was written by Dominick Grift <domg472@gmail.com>.

SEE ALSO
       selinux(8),  git-daemon(8),  setsebool(8),  semanage(8), restorecon(8),
       chcon(8)



Git daemon SELinux policy documdomg472@gmail.com         git_daemon_selinux(8)