diff --git a/config/appconfig-mcs/git_user_u_default_contexts b/config/appconfig-mcs/git_user_u_default_contexts new file mode 100644 index 0000000..f313002 --- /dev/null +++ b/config/appconfig-mcs/git_user_u_default_contexts @@ -0,0 +1,3 @@ +system_r:local_login_t:s0 git_user_r:git_user_t:s0 +system_r:remote_login_t:s0 git_user_r:git_user_t:s0 +system_r:sshd_t:s0 git_user_r:git_user_t:s0 diff --git a/config/appconfig-mls/git_user_u_default_contexts b/config/appconfig-mls/git_user_u_default_contexts new file mode 100644 index 0000000..f313002 --- /dev/null +++ b/config/appconfig-mls/git_user_u_default_contexts @@ -0,0 +1,3 @@ +system_r:local_login_t:s0 git_user_r:git_user_t:s0 +system_r:remote_login_t:s0 git_user_r:git_user_t:s0 +system_r:sshd_t:s0 git_user_r:git_user_t:s0 diff --git a/config/appconfig-standard/git_user_u_default_contexts b/config/appconfig-standard/git_user_u_default_contexts new file mode 100644 index 0000000..e38b43c --- /dev/null +++ b/config/appconfig-standard/git_user_u_default_contexts @@ -0,0 +1,3 @@ +system_r:local_login_t git_user_r:git_user_t +system_r:remote_login_t git_user_r:git_user_t +system_r:sshd_t git_user_r:git_user_t diff --git a/man/man8/ftpd_selinux.8 b/man/man8/ftpd_selinux.8 index 18f4feb..be1b503 100644 --- a/man/man8/ftpd_selinux.8 +++ b/man/man8/ftpd_selinux.8 @@ -7,9 +7,9 @@ ftpd_selinux \- Security-Enhanced Linux policy for ftp daemons. Security-Enhanced Linux provides security for ftp daemons via flexible mandatory access control. .SH FILE_CONTEXTS .PP -SELinux requires files to have a file type. File types may be specified with semanage and are restored with restorecon. Policy governs the access that daemons have to files. +SELinux requires files to have a files type. Files types may be specified with semanage and are restored with restorecon. Policy governs the access that daemons have to files. .TP -Allow ftp servers to read the /var/ftp directory by adding the public_content_t file type to the directory and by restoring the file type. +Allow ftp servers to read the /var/ftp directory by adding the public_content_t files type to the directory and by restoring the files type. .PP .B semanage fcontext -a -t public_content_t "/var/ftp(/.*)?" @@ -17,7 +17,7 @@ semanage fcontext -a -t public_content_t "/var/ftp(/.*)?" .B restorecon -R -v /var/ftp .TP -Allow ftp servers to read and write /var/tmp/incoming by adding the public_content_rw_t type to the directory and by restoring the file type. This also requires the allow_ftpd_anon_write boolean to be set. +Allow ftp servers to read and write /var/tmp/incoming by adding the public_content_rw_t type to the directory and by restoring the files type. This also requires the allow_ftpd_anon_write boolean to be set. .PP .B semanage fcontext -a -t public_content_rw_t "/var/ftp/incoming(/.*)?" diff --git a/man/man8/git_daemon_selinux.8 b/man/man8/git_daemon_selinux.8 new file mode 100644 index 0000000..eb7c083 --- /dev/null +++ b/man/man8/git_daemon_selinux.8 @@ -0,0 +1,66 @@ +.TH "git_daemon_selinux" "8" "domg472@gmail.com" "Git daemon SELinux policy documentation" +.SH "NAME" +.PP +git_daemon_selinux \- Security-Enhanced Linux policy for Git daemon. +.SH "DESCRIPTION" +.PP +Security-Enhanced Linux provides security for Git daemon via flexible mandatory access control. +.SH FILE_CONTEXTS +.PP +SELinux requires files to have a files type. Files types may be specified system wide by the administrator with the semanage command and are restored with the restorecon command. Users may use the chcon command to change the files type of it's files. Policy governs the access that Git daemon has to files. +.TP +Allow Git daemon to read the shared repository directory by adding the git_daemon_system_content_t files type to the directory and by restoring the files type. +.PP +.B +semanage fcontext -a -t git_daemon_system_content_t "/srv/git(/.*)?" +.TP +.B +restorecon -R -v /srv/git +.TP +Allow Git daemon to read the users personal repository directories by adding the git_daemon_user_content_t files type to the directory and by restoring the files type. This also requires the git_daemon_enable_homedirs boolean is set to true. +.PP +.B +semanage fcontext -a -t git_daemon_user_content_t "/home/*/public_git(/.*)?" +.TP +.B +restorecon -R -v /home/*/public_git +.TP +Allow Git daemon to read the user personal configuration file. +.PP +.B +chcon -t git_daemon_user_content_t /home/joe/.gitconfig +.SH BOOLEANS +.PP +SELinux policy is based on least privilege required and may also be customizable by setting a boolean with the setsebool command. +.TP +Allow Git daemon to read users personal repository directories with the git_daemon_user_content_t files type. +.PP +.B +setsebool -P git_daemon_enable_homedirs on +.TP +Allow Git daemon to use cifs for public file transfer services. +.PP +.B +setsebool -P git_daemon_use_cifs on +.TP +Allow Git daemon to use nfs for public file transfer services. +.PP +.B +setsebool -P git_daemon_use_nfs on +.SH ROLE +.PP +Allow Git daemon SELinux users to read, write and execute shared repositories. +.PP +.B +semanage user -a -L s0 -r s0-s0 -R git_user_r -P user git_user_u +.PP +.B +semanage login -a -s git_user_u joe +.TP +system-config-selinux is a GUI tool available to customize SELinux policy settings. +.SH AUTHOR +.PP +This manual page was written by Dominick Grift . +.SH "SEE ALSO" +.PP +selinux(8), git-daemon(8), setsebool(8), semanage(8), restorecon(8), chcon(8) diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 5e174c7..1f4274a 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -98,6 +98,7 @@ network_port(ftp_data, tcp,20,s0) network_port(ftp, tcp,21,s0) network_port(gatekeeper, udp,1718,s0, udp,1719,s0, tcp,1721,s0, tcp,7000,s0) network_port(giftd, tcp,1213,s0) +network_port(git_daemon, tcp,9418,s0) network_port(gopher, tcp,70,s0, udp,70,s0) network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0) # 8118 is for privoxy network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port diff --git a/policy/modules/services/.#exim.te b/policy/modules/services/.#exim.te deleted file mode 120000 index 9c5154e..0000000 --- a/policy/modules/services/.#exim.te +++ /dev/null @@ -1 +0,0 @@ -dwalsh@localhost.localdomain.3539:1193229490 \ No newline at end of file diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te index b137680..f59c455 100644 --- a/policy/modules/services/apache.te +++ b/policy/modules/services/apache.te @@ -536,6 +536,12 @@ optional_policy(` avahi_dbus_chat(httpd_t) ') ') + +optional_policy(` + git_daemon_read_git_daemon_system_content(httpd_t) + git_daemon_read_git_daemon_user_content(httpd_t) +') + optional_policy(` kerberos_keytab_template(httpd, httpd_t) ') diff --git a/policy/modules/services/git_daemon.fc b/policy/modules/services/git_daemon.fc new file mode 100644 index 0000000..9e40b44 --- /dev/null +++ b/policy/modules/services/git_daemon.fc @@ -0,0 +1,10 @@ + +/srv/git(/.*)? gen_context(system_u:object_r:git_daemon_system_content_t, s0) + +/usr/bin/git-daemon -- gen_context(system_u:object_r:git_daemon_exec_t, s0) + +/var/www/git/gitweb.cgi -- gen_context(system_u:object_r:httpd_gitweb_script_exec_t, s0) + +HOME_DIR/public_git(/.*)? gen_context(system_u:object_r:git_daemon_user_content_t, s0) + +HOME_DIR/\.gitconfig -- gen_context(system_u:object_r:git_daemon_user_content_t, s0) diff --git a/policy/modules/services/git_daemon.if b/policy/modules/services/git_daemon.if new file mode 100644 index 0000000..9f2ce53 --- /dev/null +++ b/policy/modules/services/git_daemon.if @@ -0,0 +1,247 @@ +## SELinux policy for the Git daemon. +## +##

+## Applies SELinux security to the Git daemon. +##

+## + +####################################### +## +## The per role template for the Git daemon module. +## +## +##

+## This template creates derived domains which are used +## for the Git daemon. +##

+##

+## This template is invoked automatically for each user, and +## generally does not need to be invoked directly +## by policy writers. +##

+## +## +## +## The prefix of the user domain (e.g., user +## is the prefix for user_t). +## +## +## +## +## The type of the user domain. +## +## +## +## +## The role associated with the user domain. +## +## +# +template(`git_daemon_per_role_template', ` + gen_require(` + type git_daemon_exec_t, git_daemon_user_content_t; + ') + + ######################################## + # + # Git daemon public declarations. + # + type $1_git_daemon_t; + application_domain($1_git_daemon_t, git_daemon_exec_t) + role $3 types $1_git_daemon_t; + + ######################################## + # + # Git daemon public policy. + # + allow $1_git_daemon_t self:fifo_file rw_fifo_file_perms; + allow $1_git_daemon_t self:netlink_route_socket { write getattr read bind create nlmsg_read }; + allow $1_git_daemon_t self:tcp_socket { bind read write accept create setopt listen }; + allow $1_git_daemon_t self:udp_socket { create connect write read getattr }; + + allow $1_git_daemon_t $2:process sigchld; + + allow $2 $1_git_daemon_t:process { ptrace signal_perms }; + + list_dirs_pattern($1_git_daemon_t, git_daemon_user_content_t, git_daemon_user_content_t) + read_files_pattern($1_git_daemon_t, git_daemon_user_content_t, git_daemon_user_content_t) + userdom_search_user_home_dirs($1, $1_git_daemon_t) + + manage_dirs_pattern($2, git_daemon_user_content_t, git_daemon_user_content_t) + manage_files_pattern($2, git_daemon_user_content_t, git_daemon_user_content_t) + exec_files_pattern($2, git_daemon_user_content_t, git_daemon_user_content_t) + userdom_user_home_dir_filetrans($1, $1_git_daemon_t, git_daemon_user_content_t, { dir file }) + + relabel_dirs_pattern($2, git_daemon_user_content_t, git_daemon_user_content_t) + relabel_files_pattern($2, git_daemon_user_content_t, git_daemon_user_content_t) + + domain_auto_trans($2, git_daemon_exec_t, $1_git_daemon_t) + + ps_process_pattern($2, $1_git_daemon_t) + + corecmd_exec_bin($1_git_daemon_t) + corecmd_search_bin($1_git_daemon_t) + + corenet_all_recvfrom_unlabeled($1_git_daemon_t) + corenet_all_recvfrom_netlabel($1_git_daemon_t) + + corenet_tcp_sendrecv_all_if($1_git_daemon_t) + corenet_tcp_sendrecv_all_nodes($1_git_daemon_t) + + corenet_tcp_bind_all_nodes($1_git_daemon_t) + + corenet_tcp_bind_git_daemon_port($1_git_daemon_t) + + files_read_etc_files($1_git_daemon_t) + + files_search_home($1_git_daemon_t) + files_search_usr($1_git_daemon_t) + + kernel_read_system_state($1_git_daemon_t) + + libs_use_ld_so($1_git_daemon_t) + libs_use_shared_libs($1_git_daemon_t) + + logging_send_syslog_msg($1_git_daemon_t) + + miscfiles_read_localization($1_git_daemon_t) + + nscd_read_pid($1_git_daemon_t) + + sysnet_read_config($1_git_daemon_t) + + userdom_use_user_terminals($1, $1_git_daemon_t) + + tunable_policy(`use_nfs_home_dirs', ` + fs_list_nfs($1_git_daemon_t) + fs_read_nfs_files($1_git_daemon_t) + ') + + tunable_policy(`use_samba_home_dirs', ` + fs_list_cifs($1_git_daemon_t) + fs_read_cifs_files($1_git_daemon_t) + ') + + optional_policy(` + automount_dontaudit_getattr_tmp_dirs($1_git_daemon_t) + fs_search_auto_mountpoints($1_git_daemon_t) + ') + + optional_policy(` + nis_use_ypbind($1_git_daemon_t) + ') +') + +######################################## +## +## Allow the specified domain to read +## Git daemon system content. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`git_daemon_read_git_daemon_system_content', ` + gen_require(` + type git_daemon_system_content_t; + ') + + list_dirs_pattern($1, git_daemon_system_content_t, git_daemon_system_content_t) + read_files_pattern($1, git_daemon_system_content_t, git_daemon_system_content_t) +') + +######################################## +## +## Allow the specified domain to manage +## Git daemon system content. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`git_daemon_manage_git_daemon_system_content', ` + gen_require(` + type git_daemon_system_content_t; + ') + + manage_dirs_pattern($1, git_daemon_system_content_t, git_daemon_system_content_t) + manage_files_pattern($1, git_daemon_system_content_t, git_daemon_system_content_t) +') + +######################################## +## +## Allow the specified domain to execute +## Git daemon system content files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`git_daemon_execute_git_daemon_system_content_files', ` + gen_require(` + type git_daemon_system_content_t; + ') + + exec_files_pattern($1, git_daemon_system_content_t, git_daemon_system_content_t) +') + +######################################## +## +## All of the rules required to administrate +## an Git daemon environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the Git daemon domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`git_daemon_admin',` + gen_require(` + type git_daemon_t, git_daemon_exec_t, git_daemon_system_content_t; + ') + + allow $1 git_daemon_t:process { ptrace signal_perms getattr }; +# TODO +') + +######################################## +## +## Allow the specified domain to read +## Git daemon user content. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`git_daemon_read_git_daemon_user_content', ` + gen_require(` + type git_daemon_user_content_t; + ') + + list_dirs_pattern($1, git_daemon_user_content_t, git_daemon_user_content_t) + read_files_pattern($1, git_daemon_user_content_t, git_daemon_user_content_t) +') diff --git a/policy/modules/services/git_daemon.te b/policy/modules/services/git_daemon.te new file mode 100644 index 0000000..423073c --- /dev/null +++ b/policy/modules/services/git_daemon.te @@ -0,0 +1,110 @@ + +policy_module(git_daemon, 0.0.1) + +######################################## +# +# Git daemon private declarations. +# +type git_daemon_t; +type git_daemon_exec_t; +inetd_service_domain(git_daemon_t, git_daemon_exec_t) +role system_r types git_daemon_t; + +application_executable_file(git_daemon_exec_t) + +type git_daemon_system_content_t; +files_type(git_daemon_system_content_t) + +type git_daemon_user_content_t; +files_poly_member(git_daemon_user_content_t) +userdom_user_home_content(user, git_daemon_user_content_t) + +## +##

+## Allow Git daemon to read home directories +##

+## +gen_tunable(git_daemon_enable_homedirs, false) + +## +##

+## Allow Git daemon to access nfs file systems +##

+## +gen_tunable(git_daemon_use_nfs, false) + +## +##

+## Allow Git daemon to access cifs file systems +##

+## +gen_tunable(git_daemon_use_cifs, false) + +######################################## +# +# Git daemon private policy. +# +allow git_daemon_t self:fifo_file rw_fifo_file_perms; +allow git_daemon_t self:netlink_route_socket { write getattr read bind create nlmsg_read }; +allow git_daemon_t self:udp_socket { write read create connect getattr }; +allow git_daemon_t self:unix_dgram_socket { write create connect }; + +list_dirs_pattern(git_daemon_t, git_daemon_system_content_t, git_daemon_system_content_t) +read_files_pattern(git_daemon_t, git_daemon_system_content_t, git_daemon_system_content_t) + +corecmd_exec_bin(git_daemon_t) +corecmd_search_bin(git_daemon_t) + +corenet_all_recvfrom_unlabeled(git_daemon_t) +corenet_all_recvfrom_netlabel(git_daemon_t) + +files_read_etc_files(git_daemon_t) + +files_search_home(git_daemon_t) +files_search_usr(git_daemon_t) + +kernel_read_system_state(git_daemon_t) + +libs_use_ld_so(git_daemon_t) +libs_use_shared_libs(git_daemon_t) + +logging_send_syslog_msg(git_daemon_t) + +miscfiles_read_localization(git_daemon_t) + +nscd_read_pid(git_daemon_t) + +sysnet_read_config(git_daemon_t) + +optional_policy(` + apache_content_template(gitweb) + apache_search_sys_content(httpd_gitweb_script_t) + files_getattr_tmp_dirs(httpd_gitweb_script_t) + git_daemon_read_git_daemon_system_content(httpd_gitweb_script_t) +') + +tunable_policy(`git_daemon_enable_homedirs',` + list_dirs_pattern(git_daemon_t, git_daemon_user_content_t, git_daemon_user_content_t) + read_files_pattern(git_daemon_t, git_daemon_user_content_t, git_daemon_user_content_t) + userdom_search_user_home_dirs(user, git_daemon_t) +') + +tunable_policy(`git_daemon_enable_homedirs && use_nfs_home_dirs', ` + fs_list_nfs(git_daemon_t) + fs_read_nfs_files(git_daemon_t) +') + +tunable_policy(`git_daemon_use_nfs', ` + fs_list_nfs(git_daemon_t) + fs_read_nfs_files(git_daemon_t) +') + +tunable_policy(`git_daemon_enable_homedirs && use_samba_home_dirs', ` + fs_list_cifs(git_daemon_t) + fs_read_cifs_files(git_daemon_t) +') + +tunable_policy(`git_daemon_use_cifs', ` + fs_list_cifs(git_daemon_t) + fs_read_cifs_files(git_daemon_t) +') diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index 64da5d6..7f2b798 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -968,6 +968,10 @@ template(`userdom_login_user_template', ` ') optional_policy(` + git_daemon_read_git_daemon_system_content($1_t) + ') + + optional_policy(` kerberos_use($1_usertype) kerberos_524_connect($1_usertype) ') @@ -1214,6 +1218,11 @@ template(`userdom_unpriv_user_template', ` games_rw_data($1_usertype) ') + ifdef(`distro_redhat', ` + optional_policy(` + git_daemon_per_role_template($1, $1_t, $1_r) + ') + ') optional_policy(` mount_run($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) ') @@ -6613,3 +6622,57 @@ interface(`userdom_relabel_all_home_files',` relabel_files_pattern($1, user_home_type, user_home_type) ') +####################################### +## +## The template for creating a Git user. +## +## +##

+## This template creates a user domain, types, and +## rules for the user's tty, pty. +##

+## +## +## +## The prefix of the user domain (e.g., user +## is the prefix for user_t). +## +## +# +template(`userdom_git_user_template',` + gen_require(` + attribute unpriv_userdomain, user_ptynode, user_ttynode; + ') + ############################## + # + # Git user public declarations + # + + userdom_base_user_template($1) + + typeattribute $1_t unpriv_userdomain; + domain_interactive_fd($1_t) + + typeattribute $1_devpts_t user_ptynode; + typeattribute $1_tty_device_t user_ttynode; + + ############################## + # + # Git user public policy + # + allow $1_t self:capability { setgid chown fowner }; + dontaudit $1_t self:capability { sys_nice fsetid }; + + allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap }; + dontaudit $1_t self:process setrlimit; + dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }; + + allow $1_t self:context contains; + + kernel_dontaudit_read_system_state($1_t) + + optional_policy(` + git_daemon_manage_git_daemon_system_content($1_t) + git_daemon_execute_git_daemon_system_content_files($1_t) + ') +') diff --git a/policy/modules/users/git_user.fc b/policy/modules/users/git_user.fc new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/policy/modules/users/git_user.fc @@ -0,0 +1 @@ + diff --git a/policy/modules/users/git_user.if b/policy/modules/users/git_user.if new file mode 100644 index 0000000..7f9ef0b --- /dev/null +++ b/policy/modules/users/git_user.if @@ -0,0 +1 @@ +## Policy for Git users diff --git a/policy/modules/users/git_user.te b/policy/modules/users/git_user.te new file mode 100644 index 0000000..7a294af --- /dev/null +++ b/policy/modules/users/git_user.te @@ -0,0 +1,9 @@ + +policy_module(git_user, 0.0.1) + +######################################## +# +# Git user private policy. +# +userdom_git_user_template(git_user) +