NAME

       git_selinux - Security Enhanced Linux Policy for the Git daemon.

DESCRIPTION

       Security-Enhanced Linux secures the Git server via flexible mandatory access control.

FILE_CONTEXTS

       SELinux  requires  files  to  have  an extended attribute to define the file type.  Policy
       governs the access daemons have to these files.   SELinux  Git  policy  is  very  flexible
       allowing users to setup their web services in as secure a method as possible.

       The following file contexts types are by default defined for Git:
       git_system_content_t
       -  Set files with git_system_content_t if you want the Git system daemon to read the file,
       and if you want the file to be modifiable and executable by all "Git shell" users.
       git_session_content_t
       - Set files with git_session_content_t if you want the Git session and  system  daemon  to
       read the file, and if you want the file to be modifiable and executable by all users. Note
       that "Git shell" users may not interact with this type.

BOOLEANS

       SELinux policy is customizable based on least access required.  Git  policy  is  extremely
       flexible and has several booleans that allow you to manipulate the policy and run Git with
       the tightest access possible.

       Allow the Git system daemon to search user home  directories  so  that  it  can  find  git
       session  content.  This is useful if you want the Git system daemon to host users personal
       repositories.
       sudo setsebool -P git_system_enable_homedirs 1

       Allow the Git system daemon to read system shared repositories on NFS shares.
       sudo setsebool -P git_system_use_nfs 1

       Allow the Git system daemon to read system shared repositories on Samba shares.
       sudo setsebool -P git_system_use_cifs 1

       Allow the Git session daemon to read users  personal  repositories  on  NFS  mounted  home
       directories.
       sudo setsebool -P use_nfs_home_dirs 1

       Allow  the  Git  session  daemon to read users personal repositories on Samba mounted home
       directories.
       sudo setsebool -P use_samba_home_dirs 1

       To also allow Git system daemon to read users  personal  repositories  on  NFS  and  Samba
       mounted  home  directories  you  must  also  allow  the  Git  system daemon to search home
       directories so that it can find the repositories.
       sudo setsebool -P git_system_enable_homedirs 1

       To allow the Git System daemon mass hosting of users personal repositories you  can  allow
       the Git daemon to listen to any unreserved ports.
       sudo setsebool -P git_session_bind_all_unreserved_ports 1

GIT_SHELL

       The  Git  policy  by  default  provides a restricted user environment to be used with "Git
       shell". This default git_shell_u SELinux user can modify and execute  generic  Git  system
       content (generic system shared repositories with type git_system_content_t).

       To add a new Linux user and map him to this Git shell user domain automatically:
       sudo useradd -Z git_shell_u joe

ADVANCED_SYSTEM_SHARED_REPOSITORY_AND GIT_SHELL_RESTRICTIONS

       Alternatively  Git  SELinux policy can be used to restrict "Git shell" users to git system
       shared repositories. The policy allows for the creation of new types of Git system content
       and  Git  shell user environment. The policy allows for delegation of types of "Git shell"
       environments to types of Git system content.

       To add a new Git system repository type,  for  example  "project1"  create  a  file  named
       project1.te and add to it:
       policy_module(project1, 1.0.0)
       git_content_template(project1)
       Next  create  a  file  named  project1.fc and add a file context specification for the new
       repository type to it:
       /srv/git/project1.git(/.*)? gen_context(system_u:object_r:git_project1_content_t,s0)
       Build a binary representation of this source policy module, load it into the policy  store
       and restore the context of the repository:
       make -f /usr/share/selinux/devel/Makefile project.pp
       sudo semodule -i project1.pp
       sudo restorecon -R -v /srv/git/project1
       To  create a "Git shell" domain that can interact with this repository create a file named
       project1user.te in the same directory as where the  source  policy  for  the  Git  systemm
       content type is and add the following:
       policy_module(project1user, 1.0.0)
       git_role_template(project1user)
       git_content_delegation(project1user_t, git_project1_content_t)
       gen_user(project1user_u, user, project1user_r, s0, s0)
       Build  a binary representation of this source policy module, load it into the policy store
       and map Linux users to the new project1user_u SELinux user:
       make -f /usr/share/selinux/devel/Makefile project1user.pp
       sudo semodule -i project1user.pp
       sudo useradd -Z project1user_u jane

       system-config-selinux is a GUI tool available to customize SELinux policy settings.

AUTHOR

       This manual page was written by Dominick Grift <domg472@gmail.com>.

SEE ALSO

       selinux(8), git(8), chcon(1), semodule(8), setsebool(8)