add selinux policy for gitea

sec-policy/selinux-gitea/files/gitea.fc

@@ -0,0 +1,25 @@
+/usr/bin/gitea		--	gen_context(system_u:object_r:gitea_exec_t,s0)
+
+/etc/gitea(/.*)?		gen_context(system_u:object_r:gitea_conf_t,s0)
+
+/var/lib/gitea(/.*)?		gen_context(system_u:object_r:gitea_var_lib_t,s0)
+
+/var/lib/gitea/.gitconfig	--	gen_context(system_u:object_r:gitea_repo_t,s0)
+
+/var/lib/gitea/conf(/.*)?            gen_context(system_u:object_r:gitea_conf_t,s0)
+
+/var/lib/gitea/gitea-repositories		gen_context(system_u:object_r:gitea_repo_home_t,s0)
+
+/var/lib/gitea/gitea-repositories/[^/]*               gen_context(system_u:object_r:gitea_repo_owner_t,s0)
+
+/var/lib/gitea/gitea-repositories/.*/.*\.git(/.*)?		gen_context(system_u:object_r:gitea_repo_t,s0)
+
+/var/lib/gitea/gitea-repositories/.*/.*\.git/objects(/.*)?	gen_context(system_u:object_r:gitea_repo_obj_t,s0)
+
+/var/lib/gitea/gitea-repositories/.*/.*\.git/hooks(/.*)?	gen_context(system_u:object_r:gitea_repo_script_exec_t,s0)
+
+/var/log/gitea(/.*)?		gen_context(system_u:object_r:gitea_log_t,s0)
+
+/var/run/gitea(/.*)?		gen_context(system_u:object_r:gitea_var_run_t,s0)
+
+/var/run/gitea.pid	--      gen_context(system_u:object_r:gitea_var_run_t,s0)

sec-policy/selinux-gitea/files/gitea.if

@@ -0,0 +1,308 @@
+
+## <summary>policy for gitea</summary>
+
+########################################
+## <summary>
+##  Role access for gitea
+## </summary>
+## <param name="role">
+##  <summary>
+##  Role allowed access
+##  </summary>
+## </param>
+## <param name="domain">
+##  <summary>
+##  User domain for the role
+##  </summary>
+## </param>
+#
+interface(`gitea_role', `
+        gen_require(`
+                attribute_role gitea_roles;
+                type gitea_t, gitea_exec_t;
+        ')
+
+        roleattribute $1 gitea_roles;
+
+        domtrans_pattern($2, gitea_exec_t, gitea_t)
+')
+
+########################################
+## <summary>
+##	Execute gitea_exec_t in the gitea domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`gitea_domtrans',`
+	gen_require(`
+		type gitea_t, gitea_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, gitea_exec_t, gitea_t)
+')
+
+######################################
+## <summary>
+##	Execute gitea in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gitea_exec',`
+	gen_require(`
+		type gitea_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, gitea_exec_t)
+')
+
+########################################
+## <summary>
+##      Read gitea's tmp files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <rolecap/>
+#
+interface(`gitea_read_tmp',`
+        gen_require(`
+                type gitea_tmp_t;
+        ')
+
+        files_search_tmp($1)
+        read_files_pattern($1, gitea_tmp_t, gitea_tmp_t)
+')
+
+########################################
+## <summary>
+##	Read gitea's log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`gitea_read_log',`
+	gen_require(`
+		type gitea_log_t;
+	')
+
+	logging_search_logs($1)
+	read_files_pattern($1, gitea_log_t, gitea_log_t)
+')
+
+########################################
+## <summary>
+##	Append to gitea log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gitea_append_log',`
+	gen_require(`
+		type gitea_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, gitea_log_t, gitea_log_t)
+')
+
+########################################
+## <summary>
+##      Manage gitea repo files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`gitea_manage_repo',`
+        gen_require(`
+                type gitea_repo_t;
+        ')
+
+	manage_dirs_pattern($1, gitea_repo_t, gitea_repo_t)
+	manage_files_pattern($1, gitea_repo_t, gitea_repo_t)
+	manage_lnk_files_pattern($1, gitea_repo_t, gitea_repo_t)
+')
+
+########################################
+## <summary>
+##	Manage gitea log files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gitea_manage_log',`
+	gen_require(`
+		type gitea_log_t;
+	')
+
+	logging_search_logs($1)
+	manage_dirs_pattern($1, gitea_log_t, gitea_log_t)
+	manage_files_pattern($1, gitea_log_t, gitea_log_t)
+	manage_lnk_files_pattern($1, gitea_log_t, gitea_log_t)
+')
+
+########################################
+## <summary>
+##	Search gitea lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gitea_search_lib',`
+	gen_require(`
+		type gitea_var_lib_t;
+	')
+
+	allow $1 gitea_var_lib_t:dir search_dir_perms;
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Read gitea lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gitea_read_lib_files',`
+	gen_require(`
+		type gitea_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	read_files_pattern($1, gitea_var_lib_t, gitea_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage gitea lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gitea_manage_lib_files',`
+	gen_require(`
+		type gitea_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_files_pattern($1, gitea_var_lib_t, gitea_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage gitea lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gitea_manage_lib_dirs',`
+	gen_require(`
+		type gitea_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, gitea_var_lib_t, gitea_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Read gitea PID files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gitea_read_pid_files',`
+	gen_require(`
+		type gitea_var_run_t;
+	')
+
+	files_search_pids($1)
+	read_files_pattern($1, gitea_var_run_t, gitea_var_run_t)
+')
+
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an gitea environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`gitea_admin',`
+	gen_require(`
+		type gitea_t;
+		type gitea_log_t;
+		type gitea_var_lib_t;
+		type gitea_var_run_t;
+	')
+
+	allow $1 gitea_t:process { signal_perms };
+	ps_process_pattern($1, gitea_t)
+
+    tunable_policy(`deny_ptrace',`',`
+        allow $1 gitea_t:process ptrace;
+    ')
+
+	logging_search_logs($1)
+	admin_pattern($1, gitea_log_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, gitea_var_lib_t)
+
+	files_search_pids($1)
+	admin_pattern($1, gitea_var_run_t)
+	optional_policy(`
+		systemd_passwd_agent_exec($1)
+		systemd_read_fifo_file_passwd_run($1)
+	')
+')

sec-policy/selinux-gitea/files/gitea.te

@@ -0,0 +1,322 @@
+policy_module(gitea, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+## <p>
+## Allows gitea to write to home directories.
+## </p>
+## </desc>
+gen_tunable(gitea_enable_homedirs, false)
+
+## <desc>
+## <p>
+## Enable gitea built-in SSH server.
+## </p>
+## </desc>
+gen_tunable(gitea_enable_ssh_server, false)
+
+type gitea_exec_t;
+corecmd_executable_file(gitea_exec_t)
+
+type gitea_t;
+init_daemon_domain(gitea_t, gitea_exec_t)
+userdom_user_application_domain(gitea_t, gitea_exec_t)
+
+attribute_role gitea_roles;
+role gitea_roles types gitea_t;
+
+type gitea_bin_t;
+domain_type(gitea_bin_t)
+corecmd_bin_entry_type(gitea_bin_t)
+role gitea_roles types gitea_bin_t;
+role system_r types gitea_bin_t;
+
+type gitea_conf_t;
+files_config_file(gitea_conf_t)
+
+type gitea_log_t;
+logging_log_file(gitea_log_t)
+
+type gitea_repo_home_t;
+files_type(gitea_repo_home_t)
+
+type gitea_repo_owner_t;
+files_type(gitea_repo_owner_t)
+
+type gitea_repo_t;
+files_type(gitea_repo_t)
+
+type gitea_var_lib_t;
+files_type(gitea_var_lib_t)
+
+type gitea_repo_obj_t;
+files_type(gitea_repo_obj_t)
+
+type gitea_repo_script_exec_t;
+corecmd_executable_file(gitea_repo_script_exec_t)
+
+type gitea_repo_script_t;
+application_domain(gitea_repo_script_t, gitea_repo_script_exec_t)
+role gitea_roles types gitea_repo_script_t;
+role system_r types gitea_repo_script_t;
+
+type gitea_var_run_t;
+init_daemon_pid_file(gitea_var_run_t, dir, "gitea")
+init_daemon_pid_file(gitea_var_run_t, file, "gitea.pid")
+
+type gitea_tmp_t;
+files_tmp_file(gitea_tmp_t)
+
+########################################
+#
+# gitea_t local policy
+#
+allow gitea_t self:fifo_file rw_fifo_file_perms;
+allow gitea_t self:capability dac_read_search;
+allow gitea_t self:process getsched;
+allow gitea_t self:tcp_socket { accept listen };
+
+allow gitea_t gitea_bin_t:process { noatsecure rlimitinh siginh sigkill };
+allow gitea_t gitea_bin_t:fifo_file write;
+allow gitea_t gitea_bin_t:fd use;
+
+corecmd_bin_domtrans(gitea_t, gitea_bin_t)
+
+#corenet_tcp_connect_git_port(gitea_t)
+#corenet_sendrecv_git_client_packets(gitea_t)
+
+corenet_all_recvfrom_unlabeled(gitea_t)
+corenet_all_recvfrom_netlabel(gitea_t)
+corenet_tcp_sendrecv_generic_if(gitea_t)
+corenet_raw_sendrecv_generic_if(gitea_t)
+corenet_tcp_sendrecv_generic_node(gitea_t)
+corenet_raw_sendrecv_generic_node(gitea_t)
+corenet_tcp_bind_generic_node(gitea_t)
+
+corenet_sendrecv_ntop_server_packets(gitea_t)
+corenet_tcp_bind_ntop_port(gitea_t)
+corenet_sendrecv_ntop_client_packets(gitea_t)
+corenet_tcp_connect_ntop_port(gitea_t)
+corenet_tcp_sendrecv_ntop_port(gitea_t)
+
+search_dirs_pattern(gitea_t, gitea_conf_t, gitea_conf_t)
+manage_files_pattern(gitea_t, gitea_conf_t, gitea_conf_t)
+
+gitea_manage_log(gitea_t)
+
+allow gitea_t gitea_var_lib_t:file map;
+manage_dirs_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
+manage_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
+manage_lnk_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
+
+filetrans_pattern(gitea_t, gitea_var_lib_t, gitea_repo_home_t, dir, "gitea-repositories")
+manage_dirs_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
+manage_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
+manage_lnk_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
+
+filetrans_pattern(gitea_t, gitea_repo_home_t, gitea_repo_owner_t, dir)
+manage_dirs_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
+manage_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
+manage_lnk_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
+
+filetrans_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_t, dir)
+files_tmp_filetrans(gitea_t, gitea_repo_t, dir)
+gitea_manage_repo(gitea_t)
+
+delete_files_pattern(gitea_t, gitea_repo_obj_t, gitea_repo_obj_t)
+allow gitea_t gitea_repo_obj_t:dir { list_dir_perms delete_dir_perms };
+
+manage_dirs_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
+manage_files_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
+
+files_tmp_filetrans(gitea_t, gitea_tmp_t, file)
+manage_dirs_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t)
+manage_files_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t)
+
+manage_dirs_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
+manage_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
+manage_lnk_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
+files_pid_filetrans(gitea_t, gitea_var_run_t, dir, "gitea")
+
+domain_use_interactive_fds(gitea_t)
+
+files_read_etc_files(gitea_t)
+files_read_usr_files(gitea_t)
+
+auth_use_nsswitch(gitea_t)
+
+logging_send_audit_msgs(gitea_t)
+
+miscfiles_read_generic_certs(gitea_t)
+miscfiles_read_localization(gitea_t)
+
+sysnet_dns_name_resolve(gitea_t)
+
+tunable_policy(`gitea_enable_ssh_server',`
+	allow gitea_t gitea_exec_t:file execute_no_trans;
+')
+
+tunable_policy(`gitea_enable_homedirs',`
+	userdom_read_user_home_content_files(gitea_t)
+')
+
+optional_policy(`
+	ssh_domtrans_keygen(gitea_t)
+
+	tunable_policy(`gitea_enable_ssh_server',`
+		corenet_tcp_bind_ssh_port(gitea_t)
+		corenet_sendrecv_ssh_server_packets(gitea_t)
+	')
+
+	tunable_policy(`!gitea_enable_ssh_server',`
+                ssh_manage_home_files(gitea_t)
+                ssh_rw_pipes(gitea_t)
+	')
+')
+
+optional_policy(`
+        postgresql_unpriv_client(gitea_t)
+        postgresql_stream_connect(gitea_t)
+        postgresql_tcp_connect(gitea_t)
+')
+
+optional_policy(`
+        mysql_stream_connect(gitea_t)
+        mysql_read_config(gitea_t)
+        mysql_tcp_connect(gitea_t)
+')
+
+optional_policy(`
+        corenet_sendrecv_smtp_client_packets(gitea_t)
+        corenet_tcp_connect_smtp_port(gitea_t)
+        corenet_tcp_sendrecv_smtp_port(gitea_t)
+
+        mta_send_mail(gitea_t)
+        mta_signal_system_mail(gitea_t)
+')
+
+########################################
+#
+# gitea_bin_t local policy
+#
+allow gitea_bin_t self:fifo_file { ioctl read write getattr };
+allow gitea_bin_t self:process getsched;
+allow gitea_bin_t self:tcp_socket { connect create getattr getopt read setopt write };
+allow gitea_bin_t self:udp_socket { bind connect create getattr read write };
+allow gitea_bin_t gitea_t:fd use;
+allow gitea_bin_t gitea_t:fifo_file { read write ioctl getattr };
+
+corenet_udp_bind_generic_node(gitea_bin_t)
+corenet_tcp_bind_generic_node(gitea_bin_t)
+
+allow gitea_bin_t gitea_repo_home_t:dir list_dir_perms;
+allow gitea_bin_t gitea_repo_owner_t:dir list_dir_perms;
+
+corenet_tcp_connect_http_port(gitea_bin_t)
+
+corecmd_exec_bin(gitea_bin_t)
+corecmd_exec_shell(gitea_bin_t)
+domtrans_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_t)
+
+files_search_tmp(gitea_bin_t)
+
+files_read_usr_files(gitea_bin_t)
+
+gitea_search_lib(gitea_bin_t)
+
+filetrans_pattern(gitea_bin_t, gitea_var_lib_t, gitea_repo_t, file, ".gitconfig.lock")
+filetrans_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t, dir)
+create_dirs_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t)
+
+filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_obj_t, dir, "objects")
+allow gitea_bin_t gitea_repo_obj_t:file map;
+manage_dirs_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
+manage_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
+manage_lnk_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
+
+filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t, dir, "hooks")
+create_dirs_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t)
+manage_files_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
+
+allow gitea_bin_t gitea_repo_t:file map;
+gitea_manage_repo(gitea_bin_t)
+
+gitea_append_log(gitea_bin_t)
+
+miscfiles_read_generic_certs(gitea_bin_t)
+miscfiles_read_localization(gitea_bin_t)
+
+domain_use_interactive_fds(gitea_bin_t)
+
+sysnet_dns_name_resolve(gitea_bin_t)
+
+tunable_policy(`gitea_enable_homedirs',`
+        userdom_manage_user_home_content_dirs(gitea_bin_t)
+        userdom_manage_user_home_content_files(gitea_bin_t)
+        userdom_read_user_home_content_files(gitea_bin_t)
+        #xdg_read_config_files(gitea_bin_t)
+')
+
+optional_policy(`
+	tunable_policy(`!gitea_enable_ssh_server',`
+		ssh_rw_pipes(gitea_bin_t)
+	')
+')
+
+########################################
+#
+# gitea_repo_script_t local policy
+#
+allow gitea_repo_script_t self:fifo_file { getattr ioctl read write };
+allow gitea_repo_script_t gitea_repo_script_exec_t:file { read_file_perms execute execute_no_trans };
+
+corecmd_exec_shell(gitea_repo_script_t)
+corecmd_exec_bin(gitea_repo_script_t)
+gitea_domtrans(gitea_repo_script_t)
+
+files_search_tmp(gitea_repo_script_t)
+
+manage_dirs_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
+manage_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
+manage_lnk_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
+
+manage_dirs_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)  # Review
+manage_files_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) # Review
+
+gitea_append_log(gitea_repo_script_t)
+
+
+tunable_policy(`gitea_enable_homedirs',`
+        #files_search_home(gitea_bin_t)
+	userdom_manage_user_home_content_dirs(gitea_bin_t)
+	userdom_manage_user_home_content_files(gitea_bin_t)
+        userdom_read_user_home_content_files(gitea_bin_t)
+        #xdg_read_config_files(gitea_bin_t)
+	#userdom_manage_user_home_content_dirs(gitea_t)
+	userdom_read_user_home_content_files(gitea_t)
+')
+
+optional_policy(`
+  gen_require(`
+  	type user_t;
+	role user_r;
+  ')
+
+  gitea_role(user_r, user_t)
+  gitea_search_lib(user_t)
+')
+
+optional_policy(`
+  gen_require(`
+        type ssh_keygen_t, user_home_dir_t, sshd_t;
+  ')
+
+  gitea_read_tmp(ssh_keygen_t);
+  gitea_search_lib(sshd_t)
+  #read_files_pattern(sshd_t, gitea_var_lib_t, gitea_var_lib_t)
+')
+