policy_module(gitea, 1.0.0)

########################################
#
# Declarations
#

## <desc>
## <p>
## Allows gitea to write to home directories.
## </p>
## </desc>
gen_tunable(gitea_enable_homedirs, false)

## <desc>
## <p>
## Enable gitea built-in SSH server.
## </p>
## </desc>
gen_tunable(gitea_enable_ssh_server, false)

type gitea_exec_t;
corecmd_executable_file(gitea_exec_t)

type gitea_t;
init_daemon_domain(gitea_t, gitea_exec_t)
userdom_user_application_domain(gitea_t, gitea_exec_t)

attribute_role gitea_roles;
role gitea_roles types gitea_t;

type gitea_bin_t;
domain_type(gitea_bin_t)
corecmd_bin_entry_type(gitea_bin_t)
role gitea_roles types gitea_bin_t;
role system_r types gitea_bin_t;

type gitea_conf_t;
files_config_file(gitea_conf_t)

type gitea_log_t;
logging_log_file(gitea_log_t)

type gitea_repo_home_t;
files_type(gitea_repo_home_t)

type gitea_repo_owner_t;
files_type(gitea_repo_owner_t)

type gitea_repo_t;
files_type(gitea_repo_t)

type gitea_var_lib_t;
files_type(gitea_var_lib_t)

type gitea_repo_obj_t;
files_type(gitea_repo_obj_t)

type gitea_repo_script_exec_t;
corecmd_executable_file(gitea_repo_script_exec_t)

type gitea_repo_script_t;
application_domain(gitea_repo_script_t, gitea_repo_script_exec_t)
role gitea_roles types gitea_repo_script_t;
role system_r types gitea_repo_script_t;

type gitea_var_run_t;
init_daemon_pid_file(gitea_var_run_t, dir, "gitea")
init_daemon_pid_file(gitea_var_run_t, file, "gitea.pid")

type gitea_tmp_t;
files_tmp_file(gitea_tmp_t)

########################################
#
# gitea_t local policy
#
allow gitea_t self:fifo_file rw_fifo_file_perms;
allow gitea_t self:capability dac_read_search;
allow gitea_t self:process getsched;
allow gitea_t self:tcp_socket { accept listen };

allow gitea_t gitea_bin_t:process { noatsecure rlimitinh siginh sigkill };
allow gitea_t gitea_bin_t:fifo_file write;
allow gitea_t gitea_bin_t:fd use;

corecmd_bin_domtrans(gitea_t, gitea_bin_t)

#corenet_tcp_connect_git_port(gitea_t)
#corenet_sendrecv_git_client_packets(gitea_t)

corenet_all_recvfrom_unlabeled(gitea_t)
corenet_all_recvfrom_netlabel(gitea_t)
corenet_tcp_sendrecv_generic_if(gitea_t)
corenet_raw_sendrecv_generic_if(gitea_t)
corenet_tcp_sendrecv_generic_node(gitea_t)
corenet_raw_sendrecv_generic_node(gitea_t)
corenet_tcp_bind_generic_node(gitea_t)

corenet_sendrecv_ntop_server_packets(gitea_t)
corenet_tcp_bind_ntop_port(gitea_t)
corenet_sendrecv_ntop_client_packets(gitea_t)
corenet_tcp_connect_ntop_port(gitea_t)
corenet_tcp_sendrecv_ntop_port(gitea_t)

search_dirs_pattern(gitea_t, gitea_conf_t, gitea_conf_t)
manage_files_pattern(gitea_t, gitea_conf_t, gitea_conf_t)

gitea_manage_log(gitea_t)

allow gitea_t gitea_var_lib_t:file map;
manage_dirs_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
manage_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)
manage_lnk_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t)

filetrans_pattern(gitea_t, gitea_var_lib_t, gitea_repo_home_t, dir, "gitea-repositories")
manage_dirs_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
manage_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)
manage_lnk_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t)

filetrans_pattern(gitea_t, gitea_repo_home_t, gitea_repo_owner_t, dir)
manage_dirs_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
manage_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)
manage_lnk_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t)

filetrans_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_t, dir)
files_tmp_filetrans(gitea_t, gitea_repo_t, dir)
gitea_manage_repo(gitea_t)

delete_files_pattern(gitea_t, gitea_repo_obj_t, gitea_repo_obj_t)
allow gitea_t gitea_repo_obj_t:dir { list_dir_perms delete_dir_perms };

manage_dirs_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)
manage_files_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)

files_tmp_filetrans(gitea_t, gitea_tmp_t, file)
manage_dirs_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t)
manage_files_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t)

manage_dirs_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
manage_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
manage_lnk_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t)
files_pid_filetrans(gitea_t, gitea_var_run_t, dir, "gitea")

domain_use_interactive_fds(gitea_t)

files_read_etc_files(gitea_t)
files_read_usr_files(gitea_t)

auth_use_nsswitch(gitea_t)

logging_send_audit_msgs(gitea_t)

miscfiles_read_generic_certs(gitea_t)
miscfiles_read_localization(gitea_t)

sysnet_dns_name_resolve(gitea_t)

tunable_policy(`gitea_enable_ssh_server',`
	allow gitea_t gitea_exec_t:file execute_no_trans;
')

tunable_policy(`gitea_enable_homedirs',`
	userdom_read_user_home_content_files(gitea_t)
')

optional_policy(`
	ssh_domtrans_keygen(gitea_t)

	tunable_policy(`gitea_enable_ssh_server',`
		corenet_tcp_bind_ssh_port(gitea_t)
		corenet_sendrecv_ssh_server_packets(gitea_t)
	')

	tunable_policy(`!gitea_enable_ssh_server',`
                ssh_manage_home_files(gitea_t)
                ssh_rw_pipes(gitea_t)
	')
')

optional_policy(`
        postgresql_unpriv_client(gitea_t)
        postgresql_stream_connect(gitea_t)
        postgresql_tcp_connect(gitea_t)
')

optional_policy(`
        mysql_stream_connect(gitea_t)
        mysql_read_config(gitea_t)
        mysql_tcp_connect(gitea_t)
')

optional_policy(`
        corenet_sendrecv_smtp_client_packets(gitea_t)
        corenet_tcp_connect_smtp_port(gitea_t)
        corenet_tcp_sendrecv_smtp_port(gitea_t)

        mta_send_mail(gitea_t)
        mta_signal_system_mail(gitea_t)
')

########################################
#
# gitea_bin_t local policy
#
allow gitea_bin_t self:fifo_file { ioctl read write getattr };
allow gitea_bin_t self:process getsched;
allow gitea_bin_t self:tcp_socket { connect create getattr getopt read setopt write };
allow gitea_bin_t self:udp_socket { bind connect create getattr read write };
allow gitea_bin_t gitea_t:fd use;
allow gitea_bin_t gitea_t:fifo_file { read write ioctl getattr };

corenet_udp_bind_generic_node(gitea_bin_t)
corenet_tcp_bind_generic_node(gitea_bin_t)

allow gitea_bin_t gitea_repo_home_t:dir list_dir_perms;
allow gitea_bin_t gitea_repo_owner_t:dir list_dir_perms;

corenet_tcp_connect_http_port(gitea_bin_t)

corecmd_exec_bin(gitea_bin_t)
corecmd_exec_shell(gitea_bin_t)
domtrans_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_t)

files_search_tmp(gitea_bin_t)

files_read_usr_files(gitea_bin_t)

gitea_search_lib(gitea_bin_t)

filetrans_pattern(gitea_bin_t, gitea_var_lib_t, gitea_repo_t, file, ".gitconfig.lock")
filetrans_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t, dir)
create_dirs_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t)

filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_obj_t, dir, "objects")
allow gitea_bin_t gitea_repo_obj_t:file map;
manage_dirs_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
manage_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)
manage_lnk_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t)

filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t, dir, "hooks")
create_dirs_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t)
manage_files_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)

allow gitea_bin_t gitea_repo_t:file map;
gitea_manage_repo(gitea_bin_t)

gitea_append_log(gitea_bin_t)

miscfiles_read_generic_certs(gitea_bin_t)
miscfiles_read_localization(gitea_bin_t)

domain_use_interactive_fds(gitea_bin_t)

sysnet_dns_name_resolve(gitea_bin_t)

tunable_policy(`gitea_enable_homedirs',`
        userdom_manage_user_home_content_dirs(gitea_bin_t)
        userdom_manage_user_home_content_files(gitea_bin_t)
        userdom_read_user_home_content_files(gitea_bin_t)
        #xdg_read_config_files(gitea_bin_t)
')

optional_policy(`
	tunable_policy(`!gitea_enable_ssh_server',`
		ssh_rw_pipes(gitea_bin_t)
	')
')

########################################
#
# gitea_repo_script_t local policy
#
allow gitea_repo_script_t self:fifo_file { getattr ioctl read write };
allow gitea_repo_script_t gitea_repo_script_exec_t:file { read_file_perms execute execute_no_trans };

corecmd_exec_shell(gitea_repo_script_t)
corecmd_exec_bin(gitea_repo_script_t)
gitea_domtrans(gitea_repo_script_t)

files_search_tmp(gitea_repo_script_t)

manage_dirs_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
manage_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)
manage_lnk_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t)

manage_dirs_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t)  # Review
manage_files_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) # Review

gitea_append_log(gitea_repo_script_t)


tunable_policy(`gitea_enable_homedirs',`
        #files_search_home(gitea_bin_t)
	userdom_manage_user_home_content_dirs(gitea_bin_t)
	userdom_manage_user_home_content_files(gitea_bin_t)
        userdom_read_user_home_content_files(gitea_bin_t)
        #xdg_read_config_files(gitea_bin_t)
	#userdom_manage_user_home_content_dirs(gitea_t)
	userdom_read_user_home_content_files(gitea_t)
')

optional_policy(`
  gen_require(`
  	type user_t;
	role user_r;
  ')

  gitea_role(user_r, user_t)
  gitea_search_lib(user_t)
')

optional_policy(`
  gen_require(`
        type ssh_keygen_t, user_home_dir_t, sshd_t;
  ')

  gitea_read_tmp(ssh_keygen_t);
  gitea_search_lib(sshd_t)
  #read_files_pattern(sshd_t, gitea_var_lib_t, gitea_var_lib_t)
')