2019-05-26 21:27:11 +03:00
|
|
|
policy_module(gitea, 1.0.0)
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# Declarations
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
## <desc>
|
|
|
|
|
## <p>
|
|
|
|
|
## Allows gitea to write to home directories.
|
|
|
|
|
## </p>
|
|
|
|
|
## </desc>
|
|
|
|
|
gen_tunable(gitea_enable_homedirs, false)
|
|
|
|
|
|
|
|
|
|
## <desc>
|
|
|
|
|
## <p>
|
|
|
|
|
## Enable gitea built-in SSH server.
|
|
|
|
|
## </p>
|
|
|
|
|
## </desc>
|
|
|
|
|
gen_tunable(gitea_enable_ssh_server, false)
|
|
|
|
|
|
|
|
|
|
type gitea_exec_t;
|
|
|
|
|
corecmd_executable_file(gitea_exec_t)
|
|
|
|
|
|
|
|
|
|
type gitea_t;
|
|
|
|
|
init_daemon_domain(gitea_t, gitea_exec_t)
|
|
|
|
|
userdom_user_application_domain(gitea_t, gitea_exec_t)
|
|
|
|
|
|
|
|
|
|
attribute_role gitea_roles;
|
|
|
|
|
role gitea_roles types gitea_t;
|
|
|
|
|
|
|
|
|
|
type gitea_bin_t;
|
|
|
|
|
domain_type(gitea_bin_t)
|
|
|
|
|
corecmd_bin_entry_type(gitea_bin_t)
|
|
|
|
|
role gitea_roles types gitea_bin_t;
|
|
|
|
|
role system_r types gitea_bin_t;
|
|
|
|
|
|
|
|
|
|
type gitea_conf_t;
|
|
|
|
|
files_config_file(gitea_conf_t)
|
|
|
|
|
|
|
|
|
|
type gitea_log_t;
|
|
|
|
|
logging_log_file(gitea_log_t)
|
|
|
|
|
|
|
|
|
|
type gitea_repo_home_t;
|
|
|
|
|
files_type(gitea_repo_home_t)
|
|
|
|
|
|
|
|
|
|
type gitea_repo_owner_t;
|
|
|
|
|
files_type(gitea_repo_owner_t)
|
|
|
|
|
|
|
|
|
|
type gitea_repo_t;
|
|
|
|
|
files_type(gitea_repo_t)
|
|
|
|
|
|
|
|
|
|
type gitea_var_lib_t;
|
|
|
|
|
files_type(gitea_var_lib_t)
|
|
|
|
|
|
|
|
|
|
type gitea_repo_obj_t;
|
|
|
|
|
files_type(gitea_repo_obj_t)
|
|
|
|
|
|
|
|
|
|
type gitea_repo_script_exec_t;
|
|
|
|
|
corecmd_executable_file(gitea_repo_script_exec_t)
|
|
|
|
|
|
|
|
|
|
type gitea_repo_script_t;
|
|
|
|
|
application_domain(gitea_repo_script_t, gitea_repo_script_exec_t)
|
|
|
|
|
role gitea_roles types gitea_repo_script_t;
|
|
|
|
|
role system_r types gitea_repo_script_t;
|
|
|
|
|
|
|
|
|
|
type gitea_var_run_t;
|
|
|
|
|
init_daemon_pid_file(gitea_var_run_t, dir, "gitea")
|
|
|
|
|
init_daemon_pid_file(gitea_var_run_t, file, "gitea.pid")
|
|
|
|
|
|
|
|
|
|
type gitea_tmp_t;
|
|
|
|
|
files_tmp_file(gitea_tmp_t)
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# gitea_t local policy
|
|
|
|
|
#
|
|
|
|
|
allow gitea_t self:fifo_file rw_fifo_file_perms;
|
|
|
|
|
allow gitea_t self:capability dac_read_search;
|
|
|
|
|
allow gitea_t self:process getsched;
|
|
|
|
|
allow gitea_t self:tcp_socket { accept listen };
|
|
|
|
|
|
|
|
|
|
allow gitea_t gitea_bin_t:process { noatsecure rlimitinh siginh sigkill };
|
|
|
|
|
allow gitea_t gitea_bin_t:fifo_file write;
|
|
|
|
|
allow gitea_t gitea_bin_t:fd use;
|
|
|
|
|
|
|
|
|
|
corecmd_bin_domtrans(gitea_t, gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
#corenet_tcp_connect_git_port(gitea_t)
|
|
|
|
|
#corenet_sendrecv_git_client_packets(gitea_t)
|
|
|
|
|
|
|
|
|
|
corenet_all_recvfrom_unlabeled(gitea_t)
|
|
|
|
|
corenet_all_recvfrom_netlabel(gitea_t)
|
|
|
|
|
corenet_tcp_sendrecv_generic_if(gitea_t)
|
|
|
|
|
corenet_raw_sendrecv_generic_if(gitea_t)
|
|
|
|
|
corenet_tcp_sendrecv_generic_node(gitea_t)
|
|
|
|
|
corenet_raw_sendrecv_generic_node(gitea_t)
|
|
|
|
|
corenet_tcp_bind_generic_node(gitea_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_ntop_server_packets(gitea_t)
|
|
|
|
|
corenet_tcp_bind_ntop_port(gitea_t)
|
|
|
|
|
corenet_sendrecv_ntop_client_packets(gitea_t)
|
|
|
|
|
corenet_tcp_connect_ntop_port(gitea_t)
|
|
|
|
|
corenet_tcp_sendrecv_ntop_port(gitea_t)
|
|
|
|
|
|
|
|
|
|
search_dirs_pattern(gitea_t, gitea_conf_t, gitea_conf_t)
|
|
|
|
|
manage_files_pattern(gitea_t, gitea_conf_t, gitea_conf_t)
|
|
|
|
|
|
|
|
|
|
gitea_manage_log(gitea_t)
|
|
|
|
|
|
|
|
|
|
allow gitea_t gitea_var_lib_t:file map;
|
|
|
|
|
manage_dirs_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
|
|
|
|
|
manage_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
|
|
|
|
|
manage_lnk_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
|
|
|
|
|
|
|
|
|
|
filetrans_pattern(gitea_t, gitea_var_lib_t, gitea_repo_home_t, dir, "gitea-repositories")
|
|
|
|
|
manage_dirs_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
|
|
|
|
|
manage_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
|
|
|
|
|
manage_lnk_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
|
|
|
|
|
|
|
|
|
|
filetrans_pattern(gitea_t, gitea_repo_home_t, gitea_repo_owner_t, dir)
|
|
|
|
|
manage_dirs_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
|
|
|
|
|
manage_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
|
|
|
|
|
manage_lnk_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
|
|
|
|
|
|
|
|
|
|
filetrans_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_t, dir)
|
|
|
|
|
files_tmp_filetrans(gitea_t, gitea_repo_t, dir)
|
|
|
|
|
gitea_manage_repo(gitea_t)
|
|
|
|
|
|
|
|
|
|
delete_files_pattern(gitea_t, gitea_repo_obj_t, gitea_repo_obj_t)
|
|
|
|
|
allow gitea_t gitea_repo_obj_t:dir { list_dir_perms delete_dir_perms };
|
|
|
|
|
|
|
|
|
|
manage_dirs_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
|
|
|
|
|
manage_files_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
|
|
|
|
|
|
|
|
|
|
files_tmp_filetrans(gitea_t, gitea_tmp_t, file)
|
|
|
|
|
manage_dirs_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t)
|
|
|
|
|
manage_files_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t)
|
|
|
|
|
|
|
|
|
|
manage_dirs_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
|
|
|
|
|
manage_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
|
|
|
|
|
manage_lnk_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
|
|
|
|
|
files_pid_filetrans(gitea_t, gitea_var_run_t, dir, "gitea")
|
|
|
|
|
|
|
|
|
|
domain_use_interactive_fds(gitea_t)
|
|
|
|
|
|
|
|
|
|
files_read_etc_files(gitea_t)
|
|
|
|
|
files_read_usr_files(gitea_t)
|
|
|
|
|
|
|
|
|
|
auth_use_nsswitch(gitea_t)
|
|
|
|
|
|
|
|
|
|
logging_send_audit_msgs(gitea_t)
|
|
|
|
|
|
|
|
|
|
miscfiles_read_generic_certs(gitea_t)
|
|
|
|
|
miscfiles_read_localization(gitea_t)
|
|
|
|
|
|
|
|
|
|
sysnet_dns_name_resolve(gitea_t)
|
|
|
|
|
|
|
|
|
|
tunable_policy(`gitea_enable_ssh_server',`
|
|
|
|
|
allow gitea_t gitea_exec_t:file execute_no_trans;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
tunable_policy(`gitea_enable_homedirs',`
|
|
|
|
|
userdom_read_user_home_content_files(gitea_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
ssh_domtrans_keygen(gitea_t)
|
|
|
|
|
|
|
|
|
|
tunable_policy(`gitea_enable_ssh_server',`
|
|
|
|
|
corenet_tcp_bind_ssh_port(gitea_t)
|
|
|
|
|
corenet_sendrecv_ssh_server_packets(gitea_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
tunable_policy(`!gitea_enable_ssh_server',`
|
|
|
|
|
ssh_manage_home_files(gitea_t)
|
|
|
|
|
ssh_rw_pipes(gitea_t)
|
|
|
|
|
')
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
postgresql_unpriv_client(gitea_t)
|
|
|
|
|
postgresql_stream_connect(gitea_t)
|
|
|
|
|
postgresql_tcp_connect(gitea_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
mysql_stream_connect(gitea_t)
|
|
|
|
|
mysql_read_config(gitea_t)
|
|
|
|
|
mysql_tcp_connect(gitea_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
corenet_sendrecv_smtp_client_packets(gitea_t)
|
|
|
|
|
corenet_tcp_connect_smtp_port(gitea_t)
|
|
|
|
|
corenet_tcp_sendrecv_smtp_port(gitea_t)
|
|
|
|
|
|
|
|
|
|
mta_send_mail(gitea_t)
|
|
|
|
|
mta_signal_system_mail(gitea_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# gitea_bin_t local policy
|
|
|
|
|
#
|
|
|
|
|
allow gitea_bin_t self:fifo_file { ioctl read write getattr };
|
|
|
|
|
allow gitea_bin_t self:process getsched;
|
|
|
|
|
allow gitea_bin_t self:tcp_socket { connect create getattr getopt read setopt write };
|
|
|
|
|
allow gitea_bin_t self:udp_socket { bind connect create getattr read write };
|
|
|
|
|
allow gitea_bin_t gitea_t:fd use;
|
|
|
|
|
allow gitea_bin_t gitea_t:fifo_file { read write ioctl getattr };
|
|
|
|
|
|
|
|
|
|
corenet_udp_bind_generic_node(gitea_bin_t)
|
|
|
|
|
corenet_tcp_bind_generic_node(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
allow gitea_bin_t gitea_repo_home_t:dir list_dir_perms;
|
|
|
|
|
allow gitea_bin_t gitea_repo_owner_t:dir list_dir_perms;
|
|
|
|
|
|
|
|
|
|
corenet_tcp_connect_http_port(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
corecmd_exec_bin(gitea_bin_t)
|
|
|
|
|
corecmd_exec_shell(gitea_bin_t)
|
|
|
|
|
domtrans_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_t)
|
|
|
|
|
|
|
|
|
|
files_search_tmp(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
files_read_usr_files(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
gitea_search_lib(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
filetrans_pattern(gitea_bin_t, gitea_var_lib_t, gitea_repo_t, file, ".gitconfig.lock")
|
|
|
|
|
filetrans_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t, dir)
|
|
|
|
|
create_dirs_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t)
|
|
|
|
|
|
|
|
|
|
filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_obj_t, dir, "objects")
|
|
|
|
|
allow gitea_bin_t gitea_repo_obj_t:file map;
|
|
|
|
|
manage_dirs_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
|
|
|
|
|
manage_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
|
|
|
|
|
manage_lnk_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
|
|
|
|
|
|
|
|
|
|
filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t, dir, "hooks")
|
|
|
|
|
create_dirs_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t)
|
|
|
|
|
manage_files_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
|
|
|
|
|
|
|
|
|
|
allow gitea_bin_t gitea_repo_t:file map;
|
|
|
|
|
gitea_manage_repo(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
gitea_append_log(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
miscfiles_read_generic_certs(gitea_bin_t)
|
|
|
|
|
miscfiles_read_localization(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
domain_use_interactive_fds(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
sysnet_dns_name_resolve(gitea_bin_t)
|
|
|
|
|
|
|
|
|
|
tunable_policy(`gitea_enable_homedirs',`
|
|
|
|
|
userdom_manage_user_home_content_dirs(gitea_bin_t)
|
|
|
|
|
userdom_manage_user_home_content_files(gitea_bin_t)
|
|
|
|
|
userdom_read_user_home_content_files(gitea_bin_t)
|
|
|
|
|
#xdg_read_config_files(gitea_bin_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
tunable_policy(`!gitea_enable_ssh_server',`
|
|
|
|
|
ssh_rw_pipes(gitea_bin_t)
|
|
|
|
|
')
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# gitea_repo_script_t local policy
|
|
|
|
|
#
|
|
|
|
|
allow gitea_repo_script_t self:fifo_file { getattr ioctl read write };
|
|
|
|
|
allow gitea_repo_script_t gitea_repo_script_exec_t:file { read_file_perms execute execute_no_trans };
|
|
|
|
|
|
|
|
|
|
corecmd_exec_shell(gitea_repo_script_t)
|
|
|
|
|
corecmd_exec_bin(gitea_repo_script_t)
|
|
|
|
|
gitea_domtrans(gitea_repo_script_t)
|
|
|
|
|
|
|
|
|
|
files_search_tmp(gitea_repo_script_t)
|
|
|
|
|
|
|
|
|
|
manage_dirs_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
|
|
|
|
|
manage_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
|
|
|
|
|
manage_lnk_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
|
|
|
|
|
|
|
|
|
|
manage_dirs_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) # Review
|
|
|
|
|
manage_files_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) # Review
|
|
|
|
|
|
|
|
|
|
gitea_append_log(gitea_repo_script_t)
|
|
|
|
|
|
2019-05-26 21:45:23 +03:00
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# macros required to insert to another module policies
|
|
|
|
|
#
|
2019-05-26 21:27:11 +03:00
|
|
|
optional_policy(`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type user_t;
|
|
|
|
|
role user_r;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
gitea_role(user_r, user_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type ssh_keygen_t, user_home_dir_t, sshd_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
gitea_read_tmp(ssh_keygen_t);
|
|
|
|
|
gitea_search_lib(sshd_t)
|
|
|
|
|
')
|
|
|
|
|
|
