policy_module(gitea, 1.0.0) ######################################## # # Declarations # ## ##

## Allows gitea to write to home directories. ##

##
gen_tunable(gitea_enable_homedirs, false) ## ##

## Enable gitea built-in SSH server. ##

##
gen_tunable(gitea_enable_ssh_server, false) type gitea_exec_t; corecmd_executable_file(gitea_exec_t) type gitea_t; init_daemon_domain(gitea_t, gitea_exec_t) userdom_user_application_domain(gitea_t, gitea_exec_t) attribute_role gitea_roles; role gitea_roles types gitea_t; type gitea_bin_t; domain_type(gitea_bin_t) corecmd_bin_entry_type(gitea_bin_t) role gitea_roles types gitea_bin_t; role system_r types gitea_bin_t; type gitea_conf_t; files_config_file(gitea_conf_t) type gitea_log_t; logging_log_file(gitea_log_t) type gitea_repo_home_t; files_type(gitea_repo_home_t) type gitea_repo_owner_t; files_type(gitea_repo_owner_t) type gitea_repo_t; files_type(gitea_repo_t) type gitea_var_lib_t; files_type(gitea_var_lib_t) type gitea_repo_obj_t; files_type(gitea_repo_obj_t) type gitea_repo_script_exec_t; corecmd_executable_file(gitea_repo_script_exec_t) type gitea_repo_script_t; application_domain(gitea_repo_script_t, gitea_repo_script_exec_t) role gitea_roles types gitea_repo_script_t; role system_r types gitea_repo_script_t; type gitea_var_run_t; init_daemon_pid_file(gitea_var_run_t, dir, "gitea") init_daemon_pid_file(gitea_var_run_t, file, "gitea.pid") type gitea_tmp_t; files_tmp_file(gitea_tmp_t) ######################################## # # gitea_t local policy # allow gitea_t self:fifo_file rw_fifo_file_perms; allow gitea_t self:capability dac_read_search; allow gitea_t self:process getsched; allow gitea_t self:tcp_socket { accept listen }; allow gitea_t gitea_bin_t:process { noatsecure rlimitinh siginh sigkill }; allow gitea_t gitea_bin_t:fifo_file write; allow gitea_t gitea_bin_t:fd use; corecmd_bin_domtrans(gitea_t, gitea_bin_t) #corenet_tcp_connect_git_port(gitea_t) #corenet_sendrecv_git_client_packets(gitea_t) corenet_all_recvfrom_unlabeled(gitea_t) corenet_all_recvfrom_netlabel(gitea_t) corenet_tcp_sendrecv_generic_if(gitea_t) corenet_raw_sendrecv_generic_if(gitea_t) corenet_tcp_sendrecv_generic_node(gitea_t) corenet_raw_sendrecv_generic_node(gitea_t) corenet_tcp_bind_generic_node(gitea_t) corenet_sendrecv_ntop_server_packets(gitea_t) corenet_tcp_bind_ntop_port(gitea_t) corenet_sendrecv_ntop_client_packets(gitea_t) corenet_tcp_connect_ntop_port(gitea_t) corenet_tcp_sendrecv_ntop_port(gitea_t) search_dirs_pattern(gitea_t, gitea_conf_t, gitea_conf_t) manage_files_pattern(gitea_t, gitea_conf_t, gitea_conf_t) gitea_manage_log(gitea_t) allow gitea_t gitea_var_lib_t:file map; manage_dirs_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t) manage_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t) manage_lnk_files_pattern(gitea_t, gitea_var_lib_t, gitea_var_lib_t) filetrans_pattern(gitea_t, gitea_var_lib_t, gitea_repo_home_t, dir, "gitea-repositories") manage_dirs_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t) manage_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t) manage_lnk_files_pattern(gitea_t, gitea_repo_home_t, gitea_repo_home_t) filetrans_pattern(gitea_t, gitea_repo_home_t, gitea_repo_owner_t, dir) manage_dirs_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t) manage_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t) manage_lnk_files_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_owner_t) filetrans_pattern(gitea_t, gitea_repo_owner_t, gitea_repo_t, dir) files_tmp_filetrans(gitea_t, gitea_repo_t, dir) gitea_manage_repo(gitea_t) delete_files_pattern(gitea_t, gitea_repo_obj_t, gitea_repo_obj_t) allow gitea_t gitea_repo_obj_t:dir { list_dir_perms delete_dir_perms }; manage_dirs_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) manage_files_pattern(gitea_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) files_tmp_filetrans(gitea_t, gitea_tmp_t, file) manage_dirs_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t) manage_files_pattern(gitea_t, gitea_tmp_t, gitea_tmp_t) manage_dirs_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t) manage_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t) manage_lnk_files_pattern(gitea_t, gitea_var_run_t, gitea_var_run_t) files_pid_filetrans(gitea_t, gitea_var_run_t, dir, "gitea") domain_use_interactive_fds(gitea_t) files_read_etc_files(gitea_t) files_read_usr_files(gitea_t) auth_use_nsswitch(gitea_t) logging_send_audit_msgs(gitea_t) miscfiles_read_generic_certs(gitea_t) miscfiles_read_localization(gitea_t) sysnet_dns_name_resolve(gitea_t) tunable_policy(`gitea_enable_ssh_server',` allow gitea_t gitea_exec_t:file execute_no_trans; ') tunable_policy(`gitea_enable_homedirs',` userdom_read_user_home_content_files(gitea_t) ') optional_policy(` ssh_domtrans_keygen(gitea_t) tunable_policy(`gitea_enable_ssh_server',` corenet_tcp_bind_ssh_port(gitea_t) corenet_sendrecv_ssh_server_packets(gitea_t) ') tunable_policy(`!gitea_enable_ssh_server',` ssh_manage_home_files(gitea_t) ssh_rw_pipes(gitea_t) ') ') optional_policy(` postgresql_unpriv_client(gitea_t) postgresql_stream_connect(gitea_t) postgresql_tcp_connect(gitea_t) ') optional_policy(` mysql_stream_connect(gitea_t) mysql_read_config(gitea_t) mysql_tcp_connect(gitea_t) ') optional_policy(` corenet_sendrecv_smtp_client_packets(gitea_t) corenet_tcp_connect_smtp_port(gitea_t) corenet_tcp_sendrecv_smtp_port(gitea_t) mta_send_mail(gitea_t) mta_signal_system_mail(gitea_t) ') ######################################## # # gitea_bin_t local policy # allow gitea_bin_t self:fifo_file { ioctl read write getattr }; allow gitea_bin_t self:process getsched; allow gitea_bin_t self:tcp_socket { connect create getattr getopt read setopt write }; allow gitea_bin_t self:udp_socket { bind connect create getattr read write }; allow gitea_bin_t gitea_t:fd use; allow gitea_bin_t gitea_t:fifo_file { read write ioctl getattr }; corenet_udp_bind_generic_node(gitea_bin_t) corenet_tcp_bind_generic_node(gitea_bin_t) allow gitea_bin_t gitea_repo_home_t:dir list_dir_perms; allow gitea_bin_t gitea_repo_owner_t:dir list_dir_perms; corenet_tcp_connect_http_port(gitea_bin_t) corecmd_exec_bin(gitea_bin_t) corecmd_exec_shell(gitea_bin_t) domtrans_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_t) files_search_tmp(gitea_bin_t) files_read_usr_files(gitea_bin_t) gitea_search_lib(gitea_bin_t) filetrans_pattern(gitea_bin_t, gitea_var_lib_t, gitea_repo_t, file, ".gitconfig.lock") filetrans_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t, dir) create_dirs_pattern(gitea_bin_t, gitea_repo_owner_t, gitea_repo_t) filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_obj_t, dir, "objects") allow gitea_bin_t gitea_repo_obj_t:file map; manage_dirs_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t) manage_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t) manage_lnk_files_pattern(gitea_bin_t, gitea_repo_obj_t, gitea_repo_obj_t) filetrans_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t, dir, "hooks") create_dirs_pattern(gitea_bin_t, gitea_repo_t, gitea_repo_script_exec_t) manage_files_pattern(gitea_bin_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) allow gitea_bin_t gitea_repo_t:file map; gitea_manage_repo(gitea_bin_t) gitea_append_log(gitea_bin_t) miscfiles_read_generic_certs(gitea_bin_t) miscfiles_read_localization(gitea_bin_t) domain_use_interactive_fds(gitea_bin_t) sysnet_dns_name_resolve(gitea_bin_t) tunable_policy(`gitea_enable_homedirs',` userdom_manage_user_home_content_dirs(gitea_bin_t) userdom_manage_user_home_content_files(gitea_bin_t) userdom_read_user_home_content_files(gitea_bin_t) #xdg_read_config_files(gitea_bin_t) ') optional_policy(` tunable_policy(`!gitea_enable_ssh_server',` ssh_rw_pipes(gitea_bin_t) ') ') ######################################## # # gitea_repo_script_t local policy # allow gitea_repo_script_t self:fifo_file { getattr ioctl read write }; allow gitea_repo_script_t gitea_repo_script_exec_t:file { read_file_perms execute execute_no_trans }; corecmd_exec_shell(gitea_repo_script_t) corecmd_exec_bin(gitea_repo_script_t) gitea_domtrans(gitea_repo_script_t) files_search_tmp(gitea_repo_script_t) manage_dirs_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t) manage_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t) manage_lnk_files_pattern(gitea_repo_script_t, gitea_repo_t, gitea_repo_t) manage_dirs_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) # Review manage_files_pattern(gitea_repo_script_t, gitea_repo_script_exec_t, gitea_repo_script_exec_t) # Review gitea_append_log(gitea_repo_script_t) ######################################## # # macros required to insert to another module policies # optional_policy(` gen_require(` type user_t; role user_r; ') gitea_role(user_r, user_t) gitea_search_lib(user_t) ') optional_policy(` gen_require(` type ssh_keygen_t, user_home_dir_t, sshd_t; ') gitea_read_tmp(ssh_keygen_t); gitea_search_lib(sshd_t) ')