Bug 1591729

Summary: cgit not able to access gitolite3 repositories (selinux)
Product: [Fedora] Fedora Reporter: François Kooman <fkooman>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 28CC: dwalsh, kevin, lvrabec, mgrepl, plautrba, pmoore, praiskup, tmz
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.14.1-36.fc28 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-07-29 03:23:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description François Kooman 2018-06-15 11:38:34 UTC
Description of problem:

it is not possible to (by default) use cgit with gitolite3 and SELinux enabled.


Version-Release number of selected component (if applicable):

cgit-1.1-10.fc28.x86_64
gitolite3-3.6.7-4.fc28.noarch
selinux-policy-3.14.1-32.fc28.noarch

How reproducible:

always

Steps to Reproduce:
1. install cgit, gitolite3, httpd
2. configure cgit and gitolite according to docs
3. also set UMASK to 0027, fix permissions etc.

Actual results:

cgit doesn't show repositories

Expected results:

cgit shows repositories

Additional info:

audit2allow shows this when running SELinux in permissive mode:


module cgitolite 1.0;

require {
	type gitosis_var_lib_t;
	type git_script_t;
	class dir { getattr open read search };
	class file { getattr map open read };
}

#============= git_script_t ==============
allow git_script_t gitosis_var_lib_t:dir { getattr open read search };
allow git_script_t gitosis_var_lib_t:file { getattr map open read };


I'm not sure where this should be fixed? Maybe in the selinux policy package?

Comment 1 Todd Zullinger 2018-06-15 14:43:29 UTC
I think it may require selinux-policy adjustments, so I'm moving the component there to get their opinion.

I wonder if this affects gitweb as well?  I would think it probably does, but I've never used gitolite.

Comment 2 Fedora Update System 2018-07-25 22:29:54 UTC
selinux-policy-3.14.1-36.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1050fb248b

Comment 3 Fedora Update System 2018-07-26 16:32:08 UTC
selinux-policy-3.14.1-36.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1050fb248b

Comment 4 Fedora Update System 2018-07-29 03:23:57 UTC
selinux-policy-3.14.1-36.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.