Commit ec22293b683b4cdadf6e6929f5c32212613ff84a
Exists in
7-2-stable-ee
Merge branch '7-2-stable' of gitlab.com:gitlab-org/omnibus-gitlab into 7-2-stable-ee
Conflicts: config/software/gitlab-rails.rb
Showing
12 changed files
with
124 additions
and
1 deletions
Show diff stats
CHANGELOG
... | ... | @@ -3,6 +3,10 @@ |
3 | 3 | The latest version of this file can be found at the master branch of the |
4 | 4 | omnibus-gitlab repository. |
5 | 5 | |
6 | +7.3.0 | |
7 | +- Add systemd support for Centos 7 | |
8 | +- Add a Centos 7 SELinux module for ssh-keygen permissions | |
9 | + | |
6 | 10 | 7.2.0 |
7 | 11 | - Pass environment variables to Unicorn and Sidekiq (Chris Portman) |
8 | 12 | - Add openssl_verify_mode to SMTP email configuration (Dionysius Marquis) | ... | ... |
README.md
... | ... | @@ -572,6 +572,10 @@ The correct operation of Git access via SSH depends on the labeling of |
572 | 572 | `/var/opt/gitlab/.ssh`. If needed you can restore this labeling by running |
573 | 573 | `sudo gitlab-ctl reconfigure`. |
574 | 574 | |
575 | +Depending on your platform, `gitlab-ctl reconfigure` will install SELinux | |
576 | +modules required to make GitLab work. These modules are listed in | |
577 | +[files/gitlab-selinux/README.md](files/gitlab-selinux/README.md). | |
578 | + | |
575 | 579 | ## Logs |
576 | 580 | |
577 | 581 | ### Tail logs in a console on the server | ... | ... |
config/projects/gitlab.rb
... | ... | @@ -0,0 +1,29 @@ |
1 | +# | |
2 | +# Copyright:: Copyright (c) 2014 GitLab B.V. | |
3 | +# License:: Apache License, Version 2.0 | |
4 | +# | |
5 | +# Licensed under the Apache License, Version 2.0 (the "License"); | |
6 | +# you may not use this file except in compliance with the License. | |
7 | +# You may obtain a copy of the License at | |
8 | +# | |
9 | +# http://www.apache.org/licenses/LICENSE-2.0 | |
10 | +# | |
11 | +# Unless required by applicable law or agreed to in writing, software | |
12 | +# distributed under the License is distributed on an "AS IS" BASIS, | |
13 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
14 | +# See the License for the specific language governing permissions and | |
15 | +# limitations under the License. | |
16 | +# | |
17 | + | |
18 | +name "gitlab-selinux" | |
19 | + | |
20 | +dependency "rsync" | |
21 | + | |
22 | +always_build true | |
23 | + | |
24 | +source :path => File.expand_path("files/gitlab-selinux", Config.project_root) | |
25 | + | |
26 | +build do | |
27 | + command "mkdir -p #{install_dir}/embedded/selinux" | |
28 | + command "#{install_dir}/embedded/bin/rsync --delete -a ./ #{install_dir}/embedded/selinux/" | |
29 | +end | ... | ... |
files/gitlab-cookbooks/gitlab/recipes/default.rb
... | ... | @@ -48,6 +48,7 @@ end |
48 | 48 | include_recipe "gitlab::users" |
49 | 49 | include_recipe "gitlab::gitlab-shell" |
50 | 50 | include_recipe "gitlab::gitlab-rails" |
51 | +include_recipe "gitlab::selinux" | |
51 | 52 | |
52 | 53 | # Create dummy unicorn and sidekiq services to receive notifications, in case |
53 | 54 | # the corresponding service recipe is not loaded below. | ... | ... |
... | ... | @@ -0,0 +1,23 @@ |
1 | +# | |
2 | +# Copyright:: Copyright (c) 2014 GitLab B.V. | |
3 | +# License:: Apache License, Version 2.0 | |
4 | +# | |
5 | +# Licensed under the Apache License, Version 2.0 (the "License"); | |
6 | +# you may not use this file except in compliance with the License. | |
7 | +# You may obtain a copy of the License at | |
8 | +# | |
9 | +# http://www.apache.org/licenses/LICENSE-2.0 | |
10 | +# | |
11 | +# Unless required by applicable law or agreed to in writing, software | |
12 | +# distributed under the License is distributed on an "AS IS" BASIS, | |
13 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
14 | +# See the License for the specific language governing permissions and | |
15 | +# limitations under the License. | |
16 | +# | |
17 | + | |
18 | +if node["platform_family"] == "rhel" && node["platform_version"] =~ /7\./ | |
19 | + ssh_keygen_module = 'gitlab-7.2.0-ssh-keygen' | |
20 | + execute "semodule -i /opt/gitlab/embedded/selinux/rhel/7/#{ssh_keygen_module}.pp" do | |
21 | + not_if "semodule -l | grep '^#{ssh_keygen_module}\\s'" | |
22 | + end | |
23 | +end | ... | ... |
files/gitlab-cookbooks/runit/files/default/gitlab-runsvdir.service
0 → 100644
files/gitlab-cookbooks/runit/recipes/default.rb
... | ... | @@ -33,8 +33,10 @@ when "rhel" |
33 | 33 | else |
34 | 34 | if node['platform_version'] =~ /^5/ |
35 | 35 | include_recipe "runit::sysvinit" |
36 | - else # >= 6.0 | |
36 | + elsif node['platform_version'] =~ /^6/ | |
37 | 37 | include_recipe "runit::upstart" |
38 | + elsif node['platform_version'] =~ /^7/ | |
39 | + include_recipe "runit::systemd" | |
38 | 40 | end |
39 | 41 | end |
40 | 42 | when "fedora" | ... | ... |
... | ... | @@ -0,0 +1,32 @@ |
1 | +# | |
2 | +# Cookbook Name:: runit | |
3 | +# Recipe:: systemd | |
4 | +# | |
5 | +# Copyright 2014 GitLab B.V. | |
6 | +# | |
7 | +# Licensed under the Apache License, Version 2.0 (the "License"); | |
8 | +# you may not use this file except in compliance with the License. | |
9 | +# You may obtain a copy of the License at | |
10 | +# | |
11 | +# http://www.apache.org/licenses/LICENSE-2.0 | |
12 | +# | |
13 | +# Unless required by applicable law or agreed to in writing, software | |
14 | +# distributed under the License is distributed on an "AS IS" BASIS, | |
15 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
16 | +# See the License for the specific language governing permissions and | |
17 | +# limitations under the License. | |
18 | +# | |
19 | + | |
20 | +link "/etc/systemd/system/default.target.wants/gitlab-runsvdir.service" do | |
21 | + to "/opt/gitlab/embedded/cookbooks/runit/files/default/gitlab-runsvdir.service" | |
22 | + notifies :run, 'execute[systemctl daemon-reload]', :immediately | |
23 | + notifies :run, 'execute[systemctl start gitlab-runsvdir]', :immediately | |
24 | +end | |
25 | + | |
26 | +execute "systemctl daemon-reload" do | |
27 | + action :nothing | |
28 | +end | |
29 | + | |
30 | +execute "systemctl start gitlab-runsvdir" do | |
31 | + action :nothing | |
32 | +end | ... | ... |
... | ... | @@ -0,0 +1,10 @@ |
1 | +# SELinux modules for GitLab | |
2 | + | |
3 | +## RHEL / Centos 7 | |
4 | + | |
5 | +rhel/7/gitlab-7.2.0-ssh-keygen.pp | |
6 | + | |
7 | +GitLab handles SSH public keys and we want to verify whether users input valid | |
8 | +SSH keys using the ssh-keygen utility. Because ssh-keygen does not accept input | |
9 | +from standard input, we need to create a temporary file. This SELinux module | |
10 | +gives ssh-keygen permission to read the temporary file we create for it. | ... | ... |
No preview for this file type