gentoo-overlay/sec-policy/selinux-gitea/files/gitea.te

314 lines
9.0 KiB
Plaintext
Raw Normal View History

2019-05-26 21:27:11 +03:00
policy_module(gitea, 1.0.0)
########################################
#
# Declarations
#
## <desc>
## <p>
## Allows gitea to write to home directories.
## </p>
## </desc>
gen_tunable(gitea_enable_homedirs, false)
## <desc>
## <p>
## Enable gitea built-in SSH server.
## </p>
## </desc>
gen_tunable(gitea_enable_ssh_server, false)
type gitea_exec_t;
corecmd_executable_file(gitea_exec_t)
type gitea_t;
init_daemon_domain(gitea_t, gitea_exec_t)
userdom_user_application_domain(gitea_t, gitea_exec_t)
attribute_role gitea_roles;
role gitea_roles types gitea_t;
type gitea_bin_t;
domain_type(gitea_bin_t)
corecmd_bin_entry_type(gitea_bin_t)
role gitea_roles types gitea_bin_t;
role system_r types gitea_bin_t;
type gitea_conf_t;
files_config_file(gitea_conf_t)
type gitea_log_t;
logging_log_file(gitea_log_t)
type gitea_repo_home_t;
files_type(gitea_repo_home_t)
type gitea_repo_owner_t;
files_type(gitea_repo_owner_t)
type gitea_repo_t;
files_type(gitea_repo_t)
type gitea_var_lib_t;
files_type(gitea_var_lib_t)
type gitea_repo_obj_t;
files_type(gitea_repo_obj_t)
type gitea_repo_script_exec_t;
corecmd_executable_file(gitea_repo_script_exec_t)
type gitea_repo_script_t;
application_domain(gitea_repo_script_t, gitea_repo_script_exec_t)
role gitea_roles types gitea_repo_script_t;
role system_r types gitea_repo_script_t;
type gitea_var_run_t;
init_daemon_pid_file(gitea_var_run_t, dir, "gitea")
init_daemon_pid_file(gitea_var_run_t, file, "gitea.pid")
type gitea_tmp_t;
files_tmp_file(gitea_tmp_t)
########################################
#
# gitea_t local policy
#
allow gitea_t self:fifo_file rw_fifo_file_perms;
allow gitea_t self:capability dac_read_search;
allow gitea_t self:process getsched;
allow gitea_t self:tcp_socket { accept listen };
allow gitea_t gitea_bin_t:process { noatsecure rlimitinh siginh sigkill };
allow gitea_t gitea_bin_t:fifo_file write;
allow gitea_t gitea_bin_t:fd use;
corecmd_bin_domtrans(gitea_t, gitea_bin_t)
#corenet_tcp_connect_git_port(gitea_t)
#corenet_sendrecv_git_client_packets(gitea_t)
corenet_all_recvfrom_unlabeled(gitea_t)
corenet_all_recvfrom_netlabel(gitea_t)
corenet_tcp_sendrecv_generic_if(gitea_t)
corenet_raw_sendrecv_generic_if(gitea_t)
corenet_tcp_sendrecv_generic_node(gitea_t)
corenet_raw_sendrecv_generic_node(gitea_t)
corenet_tcp_bind_generic_node(gitea_t)
corenet_sendrecv_ntop_server_packets(gitea_t)
corenet_tcp_bind_ntop_port(gitea_t)
corenet_sendrecv_ntop_client_packets(gitea_t)
corenet_tcp_connect_ntop_port(gitea_t)
corenet_tcp_sendrecv_ntop_port(gitea_t)
search_dirs_pattern(gitea_t, gitea_conf_t, gitea_conf_t)
manage_files_pattern(gitea_t, gitea_conf_t, gitea_conf_t)
gitea_manage_log(gitea_t)
allow gitea_t gitea_var_lib_t:file map;
manage_dirs_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
manage_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
manage_lnk_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
filetrans_pattern(gitea_t, gitea_var_lib_t, gitea_repo_home_t, dir, "gitea-repositories")
manage_dirs_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
manage_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
manage_lnk_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
filetrans_pattern(gitea_t, gitea_repo_home_t, gitea_repo_owner_t, dir)
manage_dirs_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
manage_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
manage_lnk_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
filetrans_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_t, dir)
files_tmp_filetrans(gitea_t, gitea_repo_t, dir)
gitea_manage_repo(gitea_t)
delete_files_pattern(gitea_t, gitea_repo_obj_t, gitea_repo_obj_t)
allow gitea_t gitea_repo_obj_t:dir { list_dir_perms delete_dir_perms };
manage_dirs_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
manage_files_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
files_tmp_filetrans(gitea_t, gitea_tmp_t, file)
manage_dirs_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t)
manage_files_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t)
manage_dirs_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
manage_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
manage_lnk_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
files_pid_filetrans(gitea_t, gitea_var_run_t, dir, "gitea")
domain_use_interactive_fds(gitea_t)
files_read_etc_files(gitea_t)
files_read_usr_files(gitea_t)
auth_use_nsswitch(gitea_t)
logging_send_audit_msgs(gitea_t)
miscfiles_read_generic_certs(gitea_t)
miscfiles_read_localization(gitea_t)
sysnet_dns_name_resolve(gitea_t)
tunable_policy(`gitea_enable_ssh_server',`
allow gitea_t gitea_exec_t:file execute_no_trans;
')
tunable_policy(`gitea_enable_homedirs',`
userdom_read_user_home_content_files(gitea_t)
')
optional_policy(`
ssh_domtrans_keygen(gitea_t)
tunable_policy(`gitea_enable_ssh_server',`
corenet_tcp_bind_ssh_port(gitea_t)
corenet_sendrecv_ssh_server_packets(gitea_t)
')
tunable_policy(`!gitea_enable_ssh_server',`
ssh_manage_home_files(gitea_t)
ssh_rw_pipes(gitea_t)
')
')
optional_policy(`
postgresql_unpriv_client(gitea_t)
postgresql_stream_connect(gitea_t)
postgresql_tcp_connect(gitea_t)
')
optional_policy(`
mysql_stream_connect(gitea_t)
mysql_read_config(gitea_t)
mysql_tcp_connect(gitea_t)
')
optional_policy(`
corenet_sendrecv_smtp_client_packets(gitea_t)
corenet_tcp_connect_smtp_port(gitea_t)
corenet_tcp_sendrecv_smtp_port(gitea_t)
mta_send_mail(gitea_t)
mta_signal_system_mail(gitea_t)
')
########################################
#
# gitea_bin_t local policy
#
allow gitea_bin_t self:fifo_file { ioctl read write getattr };
allow gitea_bin_t self:process getsched;
allow gitea_bin_t self:tcp_socket { connect create getattr getopt read setopt write };
allow gitea_bin_t self:udp_socket { bind connect create getattr read write };
allow gitea_bin_t gitea_t:fd use;
allow gitea_bin_t gitea_t:fifo_file { read write ioctl getattr };
corenet_udp_bind_generic_node(gitea_bin_t)
corenet_tcp_bind_generic_node(gitea_bin_t)
allow gitea_bin_t gitea_repo_home_t:dir list_dir_perms;
allow gitea_bin_t gitea_repo_owner_t:dir list_dir_perms;
corenet_tcp_connect_http_port(gitea_bin_t)
corecmd_exec_bin(gitea_bin_t)
corecmd_exec_shell(gitea_bin_t)
domtrans_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_t)
files_search_tmp(gitea_bin_t)
files_read_usr_files(gitea_bin_t)
gitea_search_lib(gitea_bin_t)
filetrans_pattern(gitea_bin_t, gitea_var_lib_t, gitea_repo_t, file, ".gitconfig.lock")
filetrans_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t, dir)
create_dirs_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t)
filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_obj_t, dir, "objects")
allow gitea_bin_t gitea_repo_obj_t:file map;
manage_dirs_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
manage_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
manage_lnk_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t, dir, "hooks")
create_dirs_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t)
manage_files_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
allow gitea_bin_t gitea_repo_t:file map;
gitea_manage_repo(gitea_bin_t)
gitea_append_log(gitea_bin_t)
miscfiles_read_generic_certs(gitea_bin_t)
miscfiles_read_localization(gitea_bin_t)
domain_use_interactive_fds(gitea_bin_t)
sysnet_dns_name_resolve(gitea_bin_t)
tunable_policy(`gitea_enable_homedirs',`
userdom_manage_user_home_content_dirs(gitea_bin_t)
userdom_manage_user_home_content_files(gitea_bin_t)
userdom_read_user_home_content_files(gitea_bin_t)
#xdg_read_config_files(gitea_bin_t)
')
optional_policy(`
tunable_policy(`!gitea_enable_ssh_server',`
ssh_rw_pipes(gitea_bin_t)
')
')
########################################
#
# gitea_repo_script_t local policy
#
allow gitea_repo_script_t self:fifo_file { getattr ioctl read write };
allow gitea_repo_script_t gitea_repo_script_exec_t:file { read_file_perms execute execute_no_trans };
corecmd_exec_shell(gitea_repo_script_t)
corecmd_exec_bin(gitea_repo_script_t)
gitea_domtrans(gitea_repo_script_t)
files_search_tmp(gitea_repo_script_t)
manage_dirs_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
manage_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
manage_lnk_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
manage_dirs_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) # Review
manage_files_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) # Review
gitea_append_log(gitea_repo_script_t)
2019-05-26 21:45:23 +03:00
########################################
#
# macros required to insert to another module policies
#
2019-05-26 21:27:11 +03:00
optional_policy(`
gen_require(`
type user_t;
role user_r;
')
gitea_role(user_r, user_t)
')
optional_policy(`
gen_require(`
type ssh_keygen_t, user_home_dir_t, sshd_t;
')
gitea_read_tmp(ssh_keygen_t);
gitea_search_lib(sshd_t)
')