Added Selinux permissions to allow key deploy

Macartur Sousa
1 parent 79ecf618
Showing 3 changed files with 50 additions and 0 deletions Show diff stats
cookbooks/gitlab/files/gitlab.te
cookbooks/gitlab/files/nginx.te
cookbooks/gitlab/recipes/default.rb
@@ -0,0 +1,11 @@
+
+module gitlab 1.0;
+
+require {
+	type initrc_tmp_t;
+	type ssh_keygen_t;
+	class file open;
+}
+
+#============= ssh_keygen_t ==============
+allow ssh_keygen_t initrc_tmp_t:file open;
@@ -0,0 +1,12 @@
+
+module nginx 1.0;
+
+require {
+	type httpd_t;
+	type unreserved_port_t;
+	class tcp_socket name_connect;
+}
+
+#============= httpd_t ==============
+allow httpd_t unreserved_port_t:tcp_socket name_connect;
+allow httpd_t http_cache_port_t:tcp_socket name_connect;
@@ -78,3 +78,30 @@ service &#39;gitlab&#39; do
   action :enable
   supports :restart => true
 end
+
+
+####################################################
+#  SELinux: allow gitlab to use '/tmp'
+####################################################
+
+cookbook_file '/etc/selinux/local/gitlab.te' do
+  notifies :run, 'execute[selinux-gitlab]'
+end
+execute 'selinux-gitlab' do
+  command 'selinux-install-module /etc/selinux/local/gitlab.te'
+  action :nothing
+end
+
+
+####################################################
+#  SELinux: allow nginx to use gitlab upstream
+####################################################
+
+cookbook_file '/etc/selinux/local/nginx.te' do
+  notifies :run, 'execute[selinux-nginx]'
+end
+execute 'selinux-nginx' do
+  command 'selinux-install-module /etc/selinux/local/nginx.te'
+  action :nothing
+end
+
...	...	@@ -0,0 +1,11 @@
	1	+
	2	+module gitlab 1.0;
	3	+
	4	+require {
	5	+ type initrc_tmp_t;
	6	+ type ssh_keygen_t;
	7	+ class file open;
	8	+}
	9	+
	10	+#============= ssh_keygen_t ==============
	11	+allow ssh_keygen_t initrc_tmp_t:file open;
...	...
...	...	@@ -0,0 +1,12 @@
	1	+
	2	+module nginx 1.0;
	3	+
	4	+require {
	5	+ type httpd_t;
	6	+ type unreserved_port_t;
	7	+ class tcp_socket name_connect;
	8	+}
	9	+
	10	+#============= httpd_t ==============
	11	+allow httpd_t unreserved_port_t:tcp_socket name_connect;
	12	+allow httpd_t http_cache_port_t:tcp_socket name_connect;
...	...
...	...	@@ -78,3 +78,30 @@ service 'gitlab' do
78	78	action :enable
79	79	supports :restart => true
80	80	end
	81	+
	82	+
	83	+####################################################
	84	+# SELinux: allow gitlab to use '/tmp'
	85	+####################################################
	86	+
	87	+cookbook_file '/etc/selinux/local/gitlab.te' do
	88	+ notifies :run, 'execute[selinux-gitlab]'
	89	+end
	90	+execute 'selinux-gitlab' do
	91	+ command 'selinux-install-module /etc/selinux/local/gitlab.te'
	92	+ action :nothing
	93	+end
	94	+
	95	+
	96	+####################################################
	97	+# SELinux: allow nginx to use gitlab upstream
	98	+####################################################
	99	+
	100	+cookbook_file '/etc/selinux/local/nginx.te' do
	101	+ notifies :run, 'execute[selinux-nginx]'
	102	+end
	103	+execute 'selinux-nginx' do
	104	+ command 'selinux-install-module /etc/selinux/local/nginx.te'
	105	+ action :nothing
	106	+end
	107	+
...	...