Added Selinux permissions to allow key deploy

Macartur Sousa
1 parent 79ecf618
Showing 3 changed files with 50 additions and 0 deletions Show diff stats
cookbooks/gitlab/files/gitlab.te
cookbooks/gitlab/files/nginx.te
cookbooks/gitlab/recipes/default.rb
@@ -0,0 +1,11 @@
+
+module gitlab 1.0;
+
+require {
+	type initrc_tmp_t;
+	type ssh_keygen_t;
+	class file open;
+}
+
+#============= ssh_keygen_t ==============
+allow ssh_keygen_t initrc_tmp_t:file open;
@@ -0,0 +1,12 @@
+
+module nginx 1.0;
+
+require {
+	type httpd_t;
+	type unreserved_port_t;
+	class tcp_socket name_connect;
+}
+
+#============= httpd_t ==============
+allow httpd_t unreserved_port_t:tcp_socket name_connect;
+allow httpd_t http_cache_port_t:tcp_socket name_connect;
@@ -78,3 +78,30 @@ service &#39;gitlab&#39; do
   action :enable
   supports :restart => true
 end
+
+
+####################################################
+#  SELinux: allow gitlab to use '/tmp'
+####################################################
+
+cookbook_file '/etc/selinux/local/gitlab.te' do
+  notifies :run, 'execute[selinux-gitlab]'
+end
+execute 'selinux-gitlab' do
+  command 'selinux-install-module /etc/selinux/local/gitlab.te'
+  action :nothing
+end
+
+
+####################################################
+#  SELinux: allow nginx to use gitlab upstream
+####################################################
+
+cookbook_file '/etc/selinux/local/nginx.te' do
+  notifies :run, 'execute[selinux-nginx]'
+end
+execute 'selinux-nginx' do
+  command 'selinux-install-module /etc/selinux/local/nginx.te'
+  action :nothing
+end
+
@@ -0,0 +1,11 @@		@@ -0,0 +1,11 @@
	1	+
	2	+module gitlab 1.0;
	3	+
	4	+require {
	5	+ type initrc_tmp_t;
	6	+ type ssh_keygen_t;
	7	+ class file open;
	8	+}
	9	+
	10	+#============= ssh_keygen_t ==============
	11	+allow ssh_keygen_t initrc_tmp_t:file open;
@@ -0,0 +1,12 @@		@@ -0,0 +1,12 @@
	1	+
	2	+module nginx 1.0;
	3	+
	4	+require {
	5	+ type httpd_t;
	6	+ type unreserved_port_t;
	7	+ class tcp_socket name_connect;
	8	+}
	9	+
	10	+#============= httpd_t ==============
	11	+allow httpd_t unreserved_port_t:tcp_socket name_connect;
	12	+allow httpd_t http_cache_port_t:tcp_socket name_connect;
	@@ -78,3 +78,30 @@ service 'gitlab' do		@@ -78,3 +78,30 @@ service 'gitlab' do
78	action :enable	78	action :enable
79	supports :restart => true	79	supports :restart => true
80	end	80	end
		81	+
		82	+
		83	+####################################################
		84	+# SELinux: allow gitlab to use '/tmp'
		85	+####################################################
		86	+
		87	+cookbook_file '/etc/selinux/local/gitlab.te' do
		88	+ notifies :run, 'execute[selinux-gitlab]'
		89	+end
		90	+execute 'selinux-gitlab' do
		91	+ command 'selinux-install-module /etc/selinux/local/gitlab.te'
		92	+ action :nothing
		93	+end
		94	+
		95	+
		96	+####################################################
		97	+# SELinux: allow nginx to use gitlab upstream
		98	+####################################################
		99	+
		100	+cookbook_file '/etc/selinux/local/nginx.te' do
		101	+ notifies :run, 'execute[selinux-nginx]'
		102	+end
		103	+execute 'selinux-nginx' do
		104	+ command 'selinux-install-module /etc/selinux/local/nginx.te'
		105	+ action :nothing
		106	+end
		107	+