Commit 9802495704223a4f08f40641a73f24ad7e6d1b73
Exists in
master
and in
2 other branches
Merge branch 'gitlab-selinux' into 'master'
Give ssh-keygen SELinux rights to read tempfiles Thanks to @tinuva for finding the solution [1] to this problem and to @axil for his nice blog post about GitLab and audit2allow [2]. [1]: https://github.com/gitlabhq/gitlabhq/issues/7413#issuecomment-53181049 [2]: http://axilleas.me/en/blog/2013/selinux-policy-for-nginx-and-gitlab-unix-socket-in-fedora-19/ See merge request !193
Showing
9 changed files
with
80 additions
and
0 deletions
Show diff stats
CHANGELOG
@@ -5,6 +5,7 @@ omnibus-gitlab repository. | @@ -5,6 +5,7 @@ omnibus-gitlab repository. | ||
5 | 5 | ||
6 | 7.3.0 | 6 | 7.3.0 |
7 | - Add systemd support for Centos 7 | 7 | - Add systemd support for Centos 7 |
8 | +- Add a Centos 7 SELinux module for ssh-keygen permissions | ||
8 | 9 | ||
9 | 7.2.0 | 10 | 7.2.0 |
10 | - Pass environment variables to Unicorn and Sidekiq (Chris Portman) | 11 | - Pass environment variables to Unicorn and Sidekiq (Chris Portman) |
README.md
@@ -572,6 +572,10 @@ The correct operation of Git access via SSH depends on the labeling of | @@ -572,6 +572,10 @@ The correct operation of Git access via SSH depends on the labeling of | ||
572 | `/var/opt/gitlab/.ssh`. If needed you can restore this labeling by running | 572 | `/var/opt/gitlab/.ssh`. If needed you can restore this labeling by running |
573 | `sudo gitlab-ctl reconfigure`. | 573 | `sudo gitlab-ctl reconfigure`. |
574 | 574 | ||
575 | +Depending on your platform, `gitlab-ctl reconfigure` will install SELinux | ||
576 | +modules required to make GitLab work. These modules are listed in | ||
577 | +[files/gitlab-selinux/README.md](files/gitlab-selinux/README.md). | ||
578 | + | ||
575 | ## Logs | 579 | ## Logs |
576 | 580 | ||
577 | ### Tail logs in a console on the server | 581 | ### Tail logs in a console on the server |
config/projects/gitlab.rb
@@ -43,6 +43,7 @@ dependency "gitlab-rails" | @@ -43,6 +43,7 @@ dependency "gitlab-rails" | ||
43 | dependency "gitlab-shell" | 43 | dependency "gitlab-shell" |
44 | dependency "gitlab-ctl" | 44 | dependency "gitlab-ctl" |
45 | dependency "gitlab-cookbooks" | 45 | dependency "gitlab-cookbooks" |
46 | +dependency "gitlab-selinux" | ||
46 | 47 | ||
47 | # version manifest file | 48 | # version manifest file |
48 | dependency "version-manifest" | 49 | dependency "version-manifest" |
@@ -0,0 +1,29 @@ | @@ -0,0 +1,29 @@ | ||
1 | +# | ||
2 | +# Copyright:: Copyright (c) 2014 GitLab B.V. | ||
3 | +# License:: Apache License, Version 2.0 | ||
4 | +# | ||
5 | +# Licensed under the Apache License, Version 2.0 (the "License"); | ||
6 | +# you may not use this file except in compliance with the License. | ||
7 | +# You may obtain a copy of the License at | ||
8 | +# | ||
9 | +# http://www.apache.org/licenses/LICENSE-2.0 | ||
10 | +# | ||
11 | +# Unless required by applicable law or agreed to in writing, software | ||
12 | +# distributed under the License is distributed on an "AS IS" BASIS, | ||
13 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
14 | +# See the License for the specific language governing permissions and | ||
15 | +# limitations under the License. | ||
16 | +# | ||
17 | + | ||
18 | +name "gitlab-selinux" | ||
19 | + | ||
20 | +dependency "rsync" | ||
21 | + | ||
22 | +always_build true | ||
23 | + | ||
24 | +source :path => File.expand_path("files/gitlab-selinux", Config.project_root) | ||
25 | + | ||
26 | +build do | ||
27 | + command "mkdir -p #{install_dir}/embedded/selinux" | ||
28 | + command "#{install_dir}/embedded/bin/rsync --delete -a ./ #{install_dir}/embedded/selinux/" | ||
29 | +end |
files/gitlab-cookbooks/gitlab/recipes/default.rb
@@ -48,6 +48,7 @@ end | @@ -48,6 +48,7 @@ end | ||
48 | include_recipe "gitlab::users" | 48 | include_recipe "gitlab::users" |
49 | include_recipe "gitlab::gitlab-shell" | 49 | include_recipe "gitlab::gitlab-shell" |
50 | include_recipe "gitlab::gitlab-rails" | 50 | include_recipe "gitlab::gitlab-rails" |
51 | +include_recipe "gitlab::selinux" | ||
51 | 52 | ||
52 | # Create dummy unicorn and sidekiq services to receive notifications, in case | 53 | # Create dummy unicorn and sidekiq services to receive notifications, in case |
53 | # the corresponding service recipe is not loaded below. | 54 | # the corresponding service recipe is not loaded below. |
@@ -0,0 +1,23 @@ | @@ -0,0 +1,23 @@ | ||
1 | +# | ||
2 | +# Copyright:: Copyright (c) 2014 GitLab B.V. | ||
3 | +# License:: Apache License, Version 2.0 | ||
4 | +# | ||
5 | +# Licensed under the Apache License, Version 2.0 (the "License"); | ||
6 | +# you may not use this file except in compliance with the License. | ||
7 | +# You may obtain a copy of the License at | ||
8 | +# | ||
9 | +# http://www.apache.org/licenses/LICENSE-2.0 | ||
10 | +# | ||
11 | +# Unless required by applicable law or agreed to in writing, software | ||
12 | +# distributed under the License is distributed on an "AS IS" BASIS, | ||
13 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
14 | +# See the License for the specific language governing permissions and | ||
15 | +# limitations under the License. | ||
16 | +# | ||
17 | + | ||
18 | +if node["platform_family"] == "rhel" && node["platform_version"] =~ /7\./ | ||
19 | + ssh_keygen_module = 'gitlab-7.2.0-ssh-keygen' | ||
20 | + execute "semodule -i /opt/gitlab/embedded/selinux/rhel/7/#{ssh_keygen_module}.pp" do | ||
21 | + not_if "semodule -l | grep '^#{ssh_keygen_module}\\s'" | ||
22 | + end | ||
23 | +end |
@@ -0,0 +1,10 @@ | @@ -0,0 +1,10 @@ | ||
1 | +# SELinux modules for GitLab | ||
2 | + | ||
3 | +## RHEL / Centos 7 | ||
4 | + | ||
5 | +rhel/7/gitlab-7.2.0-ssh-keygen.pp | ||
6 | + | ||
7 | +GitLab handles SSH public keys and we want to verify whether users input valid | ||
8 | +SSH keys using the ssh-keygen utility. Because ssh-keygen does not accept input | ||
9 | +from standard input, we need to create a temporary file. This SELinux module | ||
10 | +gives ssh-keygen permission to read the temporary file we create for it. |
No preview for this file type