Download as
Browse Code »

Commit 9437c2ee11a7b8ccaf143a1c54a90bfa9f1fbf24

Authored by Jacob Vosmaer
2 parents 4343fe3e 98024957
Exists in 7-2-stable-ee and in 1 other branch 7-2-stable

Merge commit '9802495704223a4f08f40641a73f24ad7e6d1b73' into 7-2-stable

Showing 12 changed files with 124 additions and 1 deletions   Show diff stats
CHANGELOG
  Diff comments   View file @9437c2e
... ... @@ -3,6 +3,10 @@
3 3 The latest version of this file can be found at the master branch of the
4 4 omnibus-gitlab repository.
5 5  
  6 +7.3.0
  7 +- Add systemd support for Centos 7
  8 +- Add a Centos 7 SELinux module for ssh-keygen permissions
  9 +
6 10 7.2.0
7 11 - Pass environment variables to Unicorn and Sidekiq (Chris Portman)
8 12 - Add openssl_verify_mode to SMTP email configuration (Dionysius Marquis)
... ...
README.md
  Diff comments   View file @9437c2e
... ... @@ -572,6 +572,10 @@ The correct operation of Git access via SSH depends on the labeling of
572 572 `/var/opt/gitlab/.ssh`. If needed you can restore this labeling by running
573 573 `sudo gitlab-ctl reconfigure`.
574 574  
  575 +Depending on your platform, `gitlab-ctl reconfigure` will install SELinux
  576 +modules required to make GitLab work. These modules are listed in
  577 +[files/gitlab-selinux/README.md](files/gitlab-selinux/README.md).
  578 +
575 579 ## Logs
576 580  
577 581 ### Tail logs in a console on the server
... ...
config/projects/gitlab.rb
  Diff comments   View file @9437c2e
... ... @@ -43,6 +43,7 @@ dependency "gitlab-rails"
43 43 dependency "gitlab-shell"
44 44 dependency "gitlab-ctl"
45 45 dependency "gitlab-cookbooks"
  46 +dependency "gitlab-selinux"
46 47  
47 48 # version manifest file
48 49 dependency "version-manifest"
... ...
config/software/gitlab-selinux.rb 0 → 100644
  Diff comments   View file @9437c2e
... ... @@ -0,0 +1,29 @@
  1 +#
  2 +# Copyright:: Copyright (c) 2014 GitLab B.V.
  3 +# License:: Apache License, Version 2.0
  4 +#
  5 +# Licensed under the Apache License, Version 2.0 (the "License");
  6 +# you may not use this file except in compliance with the License.
  7 +# You may obtain a copy of the License at
  8 +#
  9 +# http://www.apache.org/licenses/LICENSE-2.0
  10 +#
  11 +# Unless required by applicable law or agreed to in writing, software
  12 +# distributed under the License is distributed on an "AS IS" BASIS,
  13 +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14 +# See the License for the specific language governing permissions and
  15 +# limitations under the License.
  16 +#
  17 +
  18 +name "gitlab-selinux"
  19 +
  20 +dependency "rsync"
  21 +
  22 +always_build true
  23 +
  24 +source :path => File.expand_path("files/gitlab-selinux", Config.project_root)
  25 +
  26 +build do
  27 + command "mkdir -p #{install_dir}/embedded/selinux"
  28 + command "#{install_dir}/embedded/bin/rsync --delete -a ./ #{install_dir}/embedded/selinux/"
  29 +end
... ...
files/gitlab-cookbooks/gitlab/recipes/default.rb
  Diff comments   View file @9437c2e
... ... @@ -48,6 +48,7 @@ end
48 48 include_recipe "gitlab::users"
49 49 include_recipe "gitlab::gitlab-shell"
50 50 include_recipe "gitlab::gitlab-rails"
  51 +include_recipe "gitlab::selinux"
51 52  
52 53 # Create dummy unicorn and sidekiq services to receive notifications, in case
53 54 # the corresponding service recipe is not loaded below.
... ...
files/gitlab-cookbooks/gitlab/recipes/selinux.rb 0 → 100644
  Diff comments   View file @9437c2e
... ... @@ -0,0 +1,23 @@
  1 +#
  2 +# Copyright:: Copyright (c) 2014 GitLab B.V.
  3 +# License:: Apache License, Version 2.0
  4 +#
  5 +# Licensed under the Apache License, Version 2.0 (the "License");
  6 +# you may not use this file except in compliance with the License.
  7 +# You may obtain a copy of the License at
  8 +#
  9 +# http://www.apache.org/licenses/LICENSE-2.0
  10 +#
  11 +# Unless required by applicable law or agreed to in writing, software
  12 +# distributed under the License is distributed on an "AS IS" BASIS,
  13 +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14 +# See the License for the specific language governing permissions and
  15 +# limitations under the License.
  16 +#
  17 +
  18 +if node["platform_family"] == "rhel" && node["platform_version"] =~ /7\./
  19 + ssh_keygen_module = 'gitlab-7.2.0-ssh-keygen'
  20 + execute "semodule -i /opt/gitlab/embedded/selinux/rhel/7/#{ssh_keygen_module}.pp" do
  21 + not_if "semodule -l | grep '^#{ssh_keygen_module}\\s'"
  22 + end
  23 +end
... ...
files/gitlab-cookbooks/runit/files/default/gitlab-runsvdir.service 0 → 100644
  Diff comments   View file @9437c2e
... ... @@ -0,0 +1,6 @@
  1 +[Unit]
  2 +Description=GitLab Runit supervision process
  3 +
  4 +[Service]
  5 +ExecStart=/opt/gitlab/embedded/bin/runsvdir-start
  6 +Restart=always
... ...
files/gitlab-cookbooks/runit/recipes/default.rb
  Diff comments   View file @9437c2e
... ... @@ -33,8 +33,10 @@ when "rhel"
33 33 else
34 34 if node['platform_version'] =~ /^5/
35 35 include_recipe "runit::sysvinit"
36   - else # >= 6.0
  36 + elsif node['platform_version'] =~ /^6/
37 37 include_recipe "runit::upstart"
  38 + elsif node['platform_version'] =~ /^7/
  39 + include_recipe "runit::systemd"
38 40 end
39 41 end
40 42 when "fedora"
... ...
files/gitlab-cookbooks/runit/recipes/systemd.rb 0 → 100644
  Diff comments   View file @9437c2e
... ... @@ -0,0 +1,32 @@
  1 +#
  2 +# Cookbook Name:: runit
  3 +# Recipe:: systemd
  4 +#
  5 +# Copyright 2014 GitLab B.V.
  6 +#
  7 +# Licensed under the Apache License, Version 2.0 (the "License");
  8 +# you may not use this file except in compliance with the License.
  9 +# You may obtain a copy of the License at
  10 +#
  11 +# http://www.apache.org/licenses/LICENSE-2.0
  12 +#
  13 +# Unless required by applicable law or agreed to in writing, software
  14 +# distributed under the License is distributed on an "AS IS" BASIS,
  15 +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16 +# See the License for the specific language governing permissions and
  17 +# limitations under the License.
  18 +#
  19 +
  20 +link "/etc/systemd/system/default.target.wants/gitlab-runsvdir.service" do
  21 + to "/opt/gitlab/embedded/cookbooks/runit/files/default/gitlab-runsvdir.service"
  22 + notifies :run, 'execute[systemctl daemon-reload]', :immediately
  23 + notifies :run, 'execute[systemctl start gitlab-runsvdir]', :immediately
  24 +end
  25 +
  26 +execute "systemctl daemon-reload" do
  27 + action :nothing
  28 +end
  29 +
  30 +execute "systemctl start gitlab-runsvdir" do
  31 + action :nothing
  32 +end
... ...
files/gitlab-selinux/README.md 0 → 100644
  Diff comments   View file @9437c2e
... ... @@ -0,0 +1,10 @@
  1 +# SELinux modules for GitLab
  2 +
  3 +## RHEL / Centos 7
  4 +
  5 +rhel/7/gitlab-7.2.0-ssh-keygen.pp
  6 +
  7 +GitLab handles SSH public keys and we want to verify whether users input valid
  8 +SSH keys using the ssh-keygen utility. Because ssh-keygen does not accept input
  9 +from standard input, we need to create a temporary file. This SELinux module
  10 +gives ssh-keygen permission to read the temporary file we create for it.
... ...
files/gitlab-selinux/rhel/7/gitlab-7.2.0-ssh-keygen.pp 0 → 100644
View file @9437c2e
No preview for this file type
files/gitlab-selinux/rhel/7/gitlab-7.2.0-ssh-keygen.te 0 → 100644
  Diff comments   View file @9437c2e
... ... @@ -0,0 +1,11 @@
  1 +
  2 +module gitlab-7.2.0-ssh-keygen 1.0;
  3 +
  4 +require {
  5 + type ssh_keygen_t;
  6 + type init_tmp_t;
  7 + class file open;
  8 +}
  9 +
  10 +#============= ssh_keygen_t ==============
  11 +allow ssh_keygen_t init_tmp_t:file open;
... ...