Re: git and selinux

[Pete Stieber <pstieber@xxxxxxxxx>]

On 6/14/2012 6:26 AM, PS = Pete Stieber wrote:
PS>> Dan, how do I undo the original semanage command?

On 6/14/2012 7:37 AM, DW = Daniel J Walsh wrote:
DW> # semanage fcontext -d "/home/git(/.*)?"

Thanks for the help.  I seem to be stuck using the original solution 
suggestion made by audit2why.  Here's what I tried.

I removed all of my previous semanage commands to restored the original 
contexts for /home/git.  ssh access to the repos worked.  The 
/home/git/repos selinux context was set to 
unconfined_u:object_r:user_home_t:s0.

I'm guessing the suggested system_u:object_r:git_system_content_t:s0 is 
for the git protocol because I didn't need to use this to get the ssh 
protocol to work.

Now I was in my original state where the ssh protocol worked, but not 
http.  I looked through man httpd_selinux for clues and found 
httpd_git_content_t.  I tried the following

# semanage fcontext -a -t httpd_git_content_t "/home/git/repos(/.*)?"
# restorecon -R -v /home/git/repos

but the http protocol didn't work.  Here's the audit2why explanation:

type=AVC msg=audit(1339689105.354:33404): avc:  denied  { getattr } for 
 pid=14427 comm="httpd" path="/home/git" dev="dm-2" ino=34340865 
scontext=system_u:system_r:httpd_t:s0 
tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir

        Was caused by:
        One of the following booleans was set incorrectly.
        Description:
        Allow httpd to read user content

        Allow access by executing:
        # setsebool -P httpd_read_user_content 1
        Description:
        Allow httpd to read home directories

        Allow access by executing:
        # setsebool -P httpd_enable_homedirs 1

Apache still can't access something marked as user_home_dir_t.

So I manually changed /home/git...

# chcon -t httpd_git_content_t /home/git

Now the http protocol works, but the ssh protocol stopped working. 
Here's the audit2why output:

type=AVC msg=audit(1339689307.117:33409): avc:  denied  { search } for 
pid=14598 comm="sshd" name="git" dev="dm-2" ino=34340865 
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 
tcontext=unconfined_u:object_r:httpd_git_content_t:s0 tclass=dir

        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module 
to allow this access.

This isn't very clear, but the problem is the selinux type context on 
home/hit.

I'm going to temporarily go back to default context settings for 
/home/git and the original solution of

# setsebool -P httpd_read_user_content 1
# setsebool -P httpd_enable_homedirs 1

but I'm willing to try other, more secure solutions.

Patience is a virtue when dealing with selinux ;-)

Again, thanks for your help,
Pete
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org