Newbie Q

[Aaron Gray]

I am trying to audit2allow on F10 to allow a cgi-bin perl script to run on 
Apache. Runs fine in permissive mode not in enforcing.

I bought the O'Reilly SE Linux book and learned the basics but it does not 
really seem to help me on Fedora.

there was no /var/log/kernel so I tried /var/log/secure with the following 
command sequence

    setenforce 0

    # access the cgi from the web

    setenforce 1

    audit2allow -l -i /var/log/secure

What is strange also is the system is not flagging things up as a 
notification icon anymore in enforcing mode.

If someone could guide me or push me in the right direction I would be most 
thankful.

Aaron

[John Dennis]

Aaron Gray wrote:
>  I am trying to audit2allow on F10 to allow a cgi-bin perl script to 
>  run on Apache. Runs fine in permissive mode not in enforcing.
>
>  I bought the O'Reilly SE Linux book and learned the basics but it does 
>  not really seem to help me on Fedora.
>
>  there was no /var/log/kernel so I tried /var/log/secure with the 
>  following command sequence
>
>     setenforce 0
>
>     # access the cgi from the web
>
>     setenforce 1
>
>     audit2allow -l -i /var/log/secure 
The audit log file is
/var/log/audit/audit.log. Note, you must have root 
privileges to read it.
>  What is strange also is the system is not flagging things up as a 
>  notification icon anymore in enforcing mode. 
Do you mean the "Star" Icon
which opens the SETroubleshoot browser is 
not appearing on your desktop?

If so are there any errors in /var/log/setroubleshoot/setroubleshootd.log?

Are there actually AVC messages in the /var/log/audit/audit.log file?

What version of setroubleshoot is installed?

>  If someone could guide me or push me in the right direction I would be 
>  most thankful.
>
>  Aaron
>
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 

-- 
John Dennis <jdennis(a)redhat.com&gt;

Looking to carve out IT costs?
www.redhat.com/carveoutcosts/

[Aaron Gray]

>  Aaron Gray wrote:
> > I am trying to audit2allow on F10 to allow a cgi-bin perl script to run 
> > on Apache. Runs fine in permissive mode not in enforcing.
> >
> > I bought the O'Reilly SE Linux book and learned the basics but it does 
> > not really seem to help me on Fedora.
> >
> > there was no /var/log/kernel so I tried /var/log/secure with the 
> > following command sequence
> >
> >    setenforce 0
> >
> >    # access the cgi from the web
> >
> >    setenforce 1
> >
> >    audit2allow -l -i /var/log/secure
>  The audit log file is /var/log/audit/audit.log. Note, you must have root 
>  privileges to read it.
> >
> >
> > What is strange also is the system is not flagging things up as a 
> > notification icon anymore in enforcing mode. 
Thanks for the reply.

>  Do you mean the "Star" Icon which opens the SETroubleshoot
> browser is not 
>  appearing on your desktop? 
Yep.

>  If so are there any errors in
> /var/log/setroubleshoot/setroubleshootd.log? 
Yep.

>  Are there actually AVC messages in the /var/log/audit/audit.log file?
Yep.

>  What version of setroubleshoot is installed? 
F10's ? Version 2.0.12

It runs when I select it from the command line but not automatically on 
violations.

~~~~~~~~~~~~setroubleshooth.log~~~~~~~~~~~~
2009-03-20 16:58:15,020 [program.ERROR] setroubleshoot generated AVC, 
exiting to avoid recursion, context=system_u:system_r:setroubleshootd_t:s0, 
AVC scontext=system_u:system_r:setroubleshootd_t:s0
2009-03-20 16:58:15,020 [program.ERROR] audit event
node=localhost.localdomain type=AVC msg=audit(1237568294.768:209): avc: 
denied  { signull } for  pid=2480 comm="setroubleshootd" 
scontext=system_u:system_r:setroubleshootd_t:s0 
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
tclass=process

node=localhost.localdomain type=SYSCALL msg=audit(1237568294.768:209): 
arch=40000003 syscall=37 success=yes exit=0 a0=7d11 a1=0 a2=5cf70c a3=7d11 
items=0 ppid=1 pid=2480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" 
exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Does this give any clues ?

Aaron

[Dominick Grift]

On Fri, 2009-03-20 at 20:14 +0000, Aaron Gray wrote:
>  I am trying to audit2allow on F10 to allow a cgi-bin perl script to
> run on 
>  Apache. Runs fine in permissive mode not in enforcing.
>  
>  I bought the O'Reilly SE Linux book and learned the basics but it does not 
>  really seem to help me on Fedora.
>  
>  there was no /var/log/kernel so I tried /var/log/secure with the following 
>  command sequence
>  
>      setenforce 0
>  
>      # access the cgi from the web
>  
>      setenforce 1
>  
>      audit2allow -l -i /var/log/secure
>  
>  What is strange also is the system is not flagging things up as a 
>  notification icon anymore in enforcing mode.
>  
>  If someone could guide me or push me in the right direction I would be most 
>  thankful. 
auditd logs to /var/log/audit/audit.log

To use cgi you must set the boolean httpd_enable_cgi.

Then either label the cgi type httpd_sys_script_exec_t or create a
custom domain for your script:

mkdir myscript; cd myscript;
echo "policy_module(myscript, 0.0.1)" > myscript.te
echo "apache_content_template(myscript)" >> myscript.te
echo "/var/www/cgi-bin/myscript.pl --
gen_context(system_u:object_r:httpd_myscript_script_exec_t, s0)" >
myscript.fc

make -f /usr/share/selinux/devel/Makefile
semodule -i myscript.pp
restorecon -R -v /var/www/cgi-bin/myscript.pl

This is just a base module you will likely need to extend it. you can do
so why making the httpd_myscript_script_t permissive and then extend
your source policy with any rules required frpm audit.log/audit2why

semanage permissive -a httpd_myscript_script_t

ausearch -m avc -ts today | grep httpd_myscript_script_t | audit2allow
-R >> myscript.te; make -f /usr/share/selinux/devel/Makefile; semodule
-i myscript.pp

semanage permissive -d httpd_myscript_script_t

(to remove the permissive domain)

hth , Dominick
>  Aaron
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Aaron Gray]

>  On Fri, 2009-03-20 at 20:14 +0000, Aaron Gray wrote:
> > I am trying to audit2allow on F10 to allow a cgi-bin perl script to run 
> > on
> > Apache. Runs fine in permissive mode not in enforcing.
> >
> > I bought the O'Reilly SE Linux book and learned the basics but it does 
> > not
> > really seem to help me on Fedora.
> >
> > there was no /var/log/kernel so I tried /var/log/secure with the 
> > following
> > command sequence
> >
> >     setenforce 0
> >
> >     # access the cgi from the web
> >
> >     setenforce 1
> >
> >     audit2allow -l -i /var/log/secure
> >
> > What is strange also is the system is not flagging things up as a
> > notification icon anymore in enforcing mode.
> >
> > If someone could guide me or push me in the right direction I would be 
> > most
> > thankful.
>  auditd logs to /var/log/audit/audit.log
>
>  To use cgi you must set the boolean httpd_enable_cgi. 
Great GIT on Apache running now !:) Thanks

But not accessing the repositories, looks like a script is needed.

>  Then either label the cgi type httpd_sys_script_exec_t or create a
>  custom domain for your script:
>
>  mkdir myscript; cd myscript;
>  echo "policy_module(myscript, 0.0.1)" > myscript.te
>  echo "apache_content_template(myscript)" >> myscript.te
>  echo "/var/www/cgi-bin/myscript.pl --
>  gen_context(system_u:object_r:httpd_myscript_script_exec_t, s0)" >
>  myscript.fc
>
>  make -f /usr/share/selinux/devel/Makefile
>  semodule -i myscript.pp
>  restorecon -R -v /var/www/cgi-bin/myscript.pl 
This is interesting. command line, thanks, interesting I will have to learn 
this stuff on the command line to understand it properly.

>  This is just a base module you will likely need to extend it. you can
> do
>  so why making the httpd_myscript_script_t permissive and then extend
>  your source policy with any rules required frpm audit.log/audit2why
>
>  semanage permissive -a httpd_myscript_script_t 
Nice :)

>  ausearch -m avc -ts today | grep httpd_myscript_script_t |
> audit2allow
>  -R >> myscript.te; make -f /usr/share/selinux/devel/Makefile; semodule
>  -i myscript.pp 
This might just do the job !

>  semanage permissive -d httpd_myscript_script_t
>
>  (to remove the permissive domain) 
Is there any reason not to be using setenforce 0/1, on a machine behind 
firewall.

I will try this. Looks like theres a need of a good howto that shows how 
simple these things can be.

Many thanks Dominick

Aaron

[Dominick Grift]

On Fri, 2009-03-20 at 23:12 +0000, Aaron Gray wrote:
>  > On Fri, 2009-03-20 at 20:14 +0000, Aaron Gray wrote:
>  >> I am trying to audit2allow on F10 to allow a cgi-bin perl script to run 
>  >> on
>  >> Apache. Runs fine in permissive mode not in enforcing.
>  >>
>  >> I bought the O'Reilly SE Linux book and learned the basics but it does 
>  >> not
>  >> really seem to help me on Fedora.
>  >>
>  >> there was no /var/log/kernel so I tried /var/log/secure with the 
>  >> following
>  >> command sequence
>  >>
>  >>     setenforce 0
>  >>
>  >>     # access the cgi from the web
>  >>
>  >>     setenforce 1
>  >>
>  >>     audit2allow -l -i /var/log/secure
>  >>
>  >> What is strange also is the system is not flagging things up as a
>  >> notification icon anymore in enforcing mode.
>  >>
>  >> If someone could guide me or push me in the right direction I would be 
>  >> most
>  >> thankful.
>  > auditd logs to /var/log/audit/audit.log
>  >
>  > To use cgi you must set the boolean httpd_enable_cgi.
>  
>  Great GIT on Apache running now !:) Thanks
>  
>  But not accessing the repositories, looks like a script is needed.
>  
>  > Then either label the cgi type httpd_sys_script_exec_t or create a
>  > custom domain for your script:
>  >
>  > mkdir myscript; cd myscript;
>  > echo "policy_module(myscript, 0.0.1)" > myscript.te
>  > echo "apache_content_template(myscript)" >> myscript.te
>  > echo "/var/www/cgi-bin/myscript.pl --
>  > gen_context(system_u:object_r:httpd_myscript_script_exec_t, s0)" >
>  > myscript.fc
>  >
>  > make -f /usr/share/selinux/devel/Makefile
>  > semodule -i myscript.pp
>  > restorecon -R -v /var/www/cgi-bin/myscript.pl
>  
>  This is interesting. command line, thanks, interesting I will have to learn 
>  this stuff on the command line to understand it properly.
>  
>  > This is just a base module you will likely need to extend it. you can do
>  > so why making the httpd_myscript_script_t permissive and then extend
>  > your source policy with any rules required frpm audit.log/audit2why
>  >
>  > semanage permissive -a httpd_myscript_script_t
>  
>  Nice :)
>  
>  > ausearch -m avc -ts today | grep httpd_myscript_script_t | audit2allow
>  > -R >> myscript.te; make -f /usr/share/selinux/devel/Makefile; semodule
>  > -i myscript.pp
>  
>  This might just do the job !
>  
>  > semanage permissive -d httpd_myscript_script_t
>  >
>  > (to remove the permissive domain)
>  
>  Is there any reason not to be using setenforce 0/1, on a machine behind 
>  firewall. 
What makes you think that the security threat only comes from the
network? There might be a rogue program local to the system, and if you
setenforce 0 , you allow everything. not what i would want.

by using semanage permissive -a <domain> you only allow a specific
domain to run in permissive mode. This minimizes the risks and it
conforms to SELinux least privilege philosophy.

>  I will try this. Looks like theres a need of a good howto that shows
> how 
>  simple these things can be.
>  
>  Many thanks Dominick
>  
>  Aaron
>

Newbie Q - gitweb policy

[Aaron Gray]

>  On Fri, 2009-03-20 at 20:14 +0000, Aaron Gray wrote:
> > I am trying to audit2allow on F10 to allow a cgi-bin perl script to run 
> > on
> > Apache. Runs fine in permissive mode not in enforcing.
> > 
I had to use 'setenforce 0', remove the grep, and then whittle down the code 
a bit.

mkdir gitweb-policy;
cd gitweb-policy;
echo "policy_module(gitweb, 0.0.1)" > gitweb.te
echo "apache_content_template(gitweb)" >> gitweb.te
echo "/var/www/git/gitweb.cgi --  
gen_context(system_u:object_r:httpd_gitweb_script_exec_t, s0)" >gitweb.fc

make -f /usr/share/selinux/devel/Makefile
semodule -i gitweb.pp
restorecon -R -v /var/www/git/gitweb.cgi

setenforce 0;

Do the http access !


setenforce 1;

ausearch -m avc -ts today | audit2allow -R >> gitweb.te;

make -f /usr/share/selinux/devel/Makefile;

semodule -i gitweb.pp


Whittle the code down a bit to :-
gitweb.te
policy_module(gitweb, 0.0.1)
apache_content_template(gitweb)

require {
        type httpd_sys_script_t;
}

#============= httpd_sys_script_t ==============
files_list_default(httpd_sys_script_t)
files_read_default_files(httpd_sys_script_t)
gitweb.fc
/var/www/git/gitweb.cgi --  
gen_context(system_u:object_r:httpd_gitweb_script_exec_t, s0)

Newbie Q - gitweb policy

[Dominick Grift]

On Sat, 2009-03-21 at 02:26 +0000, Aaron Gray wrote:
>  > On Fri, 2009-03-20 at 20:14 +0000, Aaron Gray wrote:
>  >> I am trying to audit2allow on F10 to allow a cgi-bin perl script to run 
>  >> on
>  >> Apache. Runs fine in permissive mode not in enforcing.
>  >>
>  
>  I had to use 'setenforce 0', remove the grep, and then whittle down the code 
>  a bit.
>  
>  mkdir gitweb-policy;
>  cd gitweb-policy;
>  echo "policy_module(gitweb, 0.0.1)" > gitweb.te
>  echo "apache_content_template(gitweb)" >> gitweb.te
>  echo "/var/www/git/gitweb.cgi --  
>  gen_context(system_u:object_r:httpd_gitweb_script_exec_t, s0)" >gitweb.fc
>  
>  make -f /usr/share/selinux/devel/Makefile
>  semodule -i gitweb.pp
>  restorecon -R -v /var/www/git/gitweb.cgi
>  
>  setenforce 0;
>  
>  Do the http access !
>  
>  
>  setenforce 1;
>  
>  ausearch -m avc -ts today | audit2allow -R >> gitweb.te;
>  
>  make -f /usr/share/selinux/devel/Makefile;
>  
>  semodule -i gitweb.pp
>  
>  
>  Whittle the code down a bit to :-
>  gitweb.te
>  policy_module(gitweb, 0.0.1)
>  apache_content_template(gitweb)
>  
>  require {
>          type httpd_sys_script_t;
>  }
>  
>  #============= httpd_sys_script_t ==============
>  files_list_default(httpd_sys_script_t)
>  files_read_default_files(httpd_sys_script_t) 
Looks like something went wrong here.
for starters something is running in the httpd_sys_script_t domain and
not httpd_gitweb_script_t.

Second youre giving httpd_sys_script_t access to read files with type
default_t (not recommended)

http://docs.fedoraproject.org/selinux-user-guide/f10/en-US/

Heres my git policy:
policy_module(git_daemon, 0.0.1) 

########################################
#
# Git daemon declarations
#

attribute git_daemon_user_content_type;
attribute git_daemon_system_content_type;

type git_daemon_t;
type git_daemon_exec_t;
inetd_service_domain(git_daemon_t, git_daemon_exec_t)
role system_r types git_daemon_t;

application_executable_file(git_daemon_exec_t)

type git_daemon_system_content_t, git_daemon_system_content_type;
typeattribute git_daemon_system_content_t
git_daemon_system_content_type;
files_type(git_daemon_system_content_t)

## <desc>
## <p>
## Allow Git daemon to read home directories.
## </p>
## </desc>
gen_tunable(git_daemon_enable_homedirs, false)

## <desc>
## <p>
## Allow Git daemon to access nfs file systems.
## </p>
## </desc>
gen_tunable(git_daemon_use_nfs, false)

## <desc>
## <p>
## Allow Git daemon to access cifs file systems.
## </p>
## </desc>
gen_tunable(git_daemon_use_cifs, false)

########################################
#
# Git daemon policy
#

allow git_daemon_t self:fifo_file rw_fifo_file_perms;
allow git_daemon_t self:netlink_route_socket { write getattr read bind
create nlmsg_read };
allow git_daemon_t self:udp_socket { write read create connect
getattr };
allow git_daemon_t self:unix_dgram_socket { write create connect };

list_dirs_pattern(git_daemon_t, git_daemon_system_content_type,
git_daemon_system_content_type)
read_files_pattern(git_daemon_t, git_daemon_system_content_type,
git_daemon_system_content_type)

corecmd_exec_bin(git_daemon_t)

corenet_all_recvfrom_unlabeled(git_daemon_t)
corenet_all_recvfrom_netlabel(git_daemon_t)

files_read_etc_files(git_daemon_t)
files_search_usr(git_daemon_t)

fs_search_auto_mountpoints(git_daemon_t)

kernel_read_system_state(git_daemon_t)

libs_use_ld_so(git_daemon_t)
libs_use_shared_libs(git_daemon_t)

logging_send_syslog_msg(git_daemon_t)

miscfiles_read_localization(git_daemon_t)

miscfiles_read_public_files(git_daemon_t)

sysnet_read_config(git_daemon_t)

optional_policy(`
	apache_content_template(gitweb)
	apache_search_sys_content(httpd_gitweb_script_t)
	files_getattr_tmp_dirs(httpd_gitweb_script_t)
	git_daemon_read_system_content(httpd_gitweb_script_t)
')

optional_policy(`
	nscd_read_pid(git_daemon_t)
')

tunable_policy(`git_daemon_enable_homedirs && use_nfs_home_dirs', `
	fs_list_nfs(git_daemon_t)
	fs_read_nfs_files(git_daemon_t)
')

tunable_policy(`git_daemon_use_nfs', `
	fs_list_nfs(git_daemon_t)
	fs_read_nfs_files(git_daemon_t)
')

tunable_policy(`git_daemon_enable_homedirs && use_samba_home_dirs', `
	fs_list_cifs(git_daemon_t)
	fs_read_cifs_files(git_daemon_t)
')

tunable_policy(`git_daemon_use_cifs', `
	fs_list_cifs(git_daemon_t)
	fs_read_cifs_files(git_daemon_t)
')

tunable_policy(`git_daemon_enable_homedirs', `
	list_dirs_pattern(git_daemon_t, git_daemon_user_content_type,
git_daemon_user_content_type)
	read_files_pattern(git_daemon_t, git_daemon_user_content_type,
git_daemon_user_content_type)
	userdom_search_all_users_home_dirs(git_daemon_t)
')

#EOF

## <summary>SELinux policy for Git daemon.</summary>
## <desc>
##	<p>
##	Git daemon is a really simple server for Git
##	repositories.
##	</p>
## </desc>

#######################################
## <summary>
##  The per role template for the Git daemon module.
## </summary>
## <desc>
## 	<p>
## 	This template creates derived domains which are used
## 	for Git daemon.
## 	</p>
## 	<p>
## 	This template is invoked automatically for each user, and
## 	generally does not need to be invoked directly
## 	by policy writers.
## 	</p>
## </desc>
## <param name="userdomain_prefix">
## 	<summary>
## 	The prefix of the user domain (e.g., user
## 	is the prefix for user_t).
## 	</summary>
## </param>
## <param name="user_domain">
## 	<summary>
## 	The type of the user domain.
## 	</summary>
## 	</param>
## 	<param name="user_role">
## 	<summary>
## 	The role associated with the user domain.
## 	</summary>
## </param>
#
template(`git_daemon_per_role_template', `
	gen_require(`
		type git_daemon_exec_t;
		attribute git_daemon_user_content_type;
	')

	########################################
	#
	#  Git daemon public declarations.
	#

	type $1_git_daemon_t;
	application_domain($1_git_daemon_t, git_daemon_exec_t)
	role $3 types $1_git_daemon_t;

	type $1_git_daemon_home_t, git_daemon_user_content_type;
	userdom_user_home_content($1, $1_git_daemon_home_t)

	typeattribute $1_git_daemon_home_t git_daemon_user_content_type;

	########################################
	#
	# Git daemon public policy.
	#

	allow $1_git_daemon_t self:fifo_file rw_fifo_file_perms;
	allow $1_git_daemon_t self:netlink_route_socket { write getattr read
bind create nlmsg_read };
	allow $1_git_daemon_t self:tcp_socket { bind read write accept create
setopt listen };
	allow $1_git_daemon_t self:udp_socket { create connect write read
getattr };	

	allow $1_git_daemon_t $2:process sigchld;

	allow $2 $1_git_daemon_t:process { ptrace signal_perms };

	git_daemon_read_user_content($1, $1_git_daemon_t)

	manage_dirs_pattern($2, git_daemon_user_content_type,
git_daemon_user_content_type)
	manage_files_pattern($2, git_daemon_user_content_type,
git_daemon_user_content_type)
	exec_files_pattern($2, git_daemon_user_content_type,
git_daemon_user_content_type)
	userdom_search_user_home_dirs($1, $1_git_daemon_t)
	userdom_user_home_dir_filetrans($1, $1_git_daemon_t,
$1_git_daemon_home_t, { dir file })

	relabel_dirs_pattern($2, git_daemon_user_content_type,
git_daemon_user_content_type)
	relabel_files_pattern($2, git_daemon_user_content_type,
git_daemon_user_content_type)

	domain_auto_trans($2, git_daemon_exec_t, $1_git_daemon_t)

	ps_process_pattern($2, $1_git_daemon_t)

	corecmd_exec_bin($1_git_daemon_t)

	corenet_all_recvfrom_unlabeled($1_git_daemon_t)
	corenet_all_recvfrom_netlabel($1_git_daemon_t)

 	corenet_tcp_sendrecv_all_if($1_git_daemon_t)
	corenet_tcp_sendrecv_all_nodes($1_git_daemon_t)

 	corenet_tcp_bind_all_nodes($1_git_daemon_t)

	corenet_tcp_bind_git_daemon_port($1_git_daemon_t)

	files_read_etc_files($1_git_daemon_t)

	files_search_home($1_git_daemon_t)
	files_search_usr($1_git_daemon_t)

	fs_search_auto_mountpoints($1_git_daemon_t)

	kernel_read_system_state($1_git_daemon_t)

	libs_use_ld_so($1_git_daemon_t)
	libs_use_shared_libs($1_git_daemon_t)

	logging_send_syslog_msg($1_git_daemon_t)

	miscfiles_read_localization($1_git_daemon_t)

	sysnet_read_config($1_git_daemon_t)

	userdom_use_user_terminals($1, $1_git_daemon_t)

	tunable_policy(`use_nfs_home_dirs', `
		fs_list_nfs($1_git_daemon_t)
 		fs_read_nfs_files($1_git_daemon_t)
	')

	tunable_policy(`use_samba_home_dirs', `
		fs_list_cifs($1_git_daemon_t)
		fs_read_cifs_files($1_git_daemon_t)
	')

	optional_policy(`
		nscd_read_pid($1_git_daemon_t)
	')

	optional_policy(`
		nis_use_ypbind($1_git_daemon_t)
	')
')

########################################
## <summary>
##	Allow the specified domain to read
##	Git daemon system content.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_read_system_content', `
	gen_require(`
		attribute git_daemon_system_content_type;
	')

	files_search_var($1)
	list_dirs_pattern($1, git_daemon_system_content_type,
git_daemon_system_content_type)
	read_files_pattern($1, git_daemon_system_content_type,
git_daemon_system_content_type)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	Git daemon system content.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_manage_system_content', `
	gen_require(`
		attribute git_daemon_system_content_type;
	')

	files_search_var($1)
	manage_dirs_pattern($1, git_daemon_system_content_type,
git_daemon_system_content_type)
	manage_files_pattern($1, git_daemon_system_content_type,
git_daemon_system_content_type)
')

########################################
## <summary>
##	Allow the specified domain to execute
##	Git daemon system content files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_execute_system_content_files', `
	gen_require(`
		attribute git_daemon_system_content_type;
	')
	
	files_search_var($1)
	exec_files_pattern($1, git_daemon_system_content_type,
git_daemon_system_content_type)
')

########################################
## <summary>
##	Allow the specified domain to read
##	Git daemon personal repositories.
## </summary>
## <param name="userdomain_prefix">
## 	<summary>
## 	The prefix of the user domain (e.g., user
## 	is the prefix for user_t).
## 	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`git_daemon_read_user_content', `
	gen_require(`
		attribute git_daemon_user_content_type;
	')

	allow $2 git_daemon_user_content_type:dir list_dir_perms;
	allow $2 git_daemon_user_content_type:file read_file_perms;
	userdom_search_user_home_dirs($1, $2)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	Git daemon personal repositories.
## </summary>
## <param name="userdomain_prefix">
## 	<summary>
## 	The prefix of the user domain (e.g., user
## 	is the prefix for user_t).
## 	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`git_daemon_manage_user_content', `
	gen_require(`
		attribute git_daemon_user_content_type;
	')

	allow $2 git_daemon_user_content_type:dir manage_dir_perms;
	allow $2 git_daemon_user_content_type:file manage_file_perms;
	userdom_user_home_dir_filetrans($1, $2, git_daemon_user_content_type,
{ dir file })
	userdom_search_user_home_dirs($1, $2)
')

########################################
## <summary>
##	Allow the specified domain to relabel
##	Git daemon personal repositories.
## </summary>
## <param name="userdomain_prefix">
## 	<summary>
## 	The prefix of the user domain (e.g., user
## 	is the prefix for user_t).
## 	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`git_daemon_relabel_user_content', `
	gen_require(`
		attribute git_daemon_user_content_type;
	')

	allow $2 git_daemon_user_content_type:dir relabel_dir_perms;
	allow $2 git_daemon_user_content_type:file relabel_file_perms;
	userdom_search_user_home_dirs($1, $2)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	all Git daemon content.
## </summary>
## <param name="userdomain_prefix">
## 	<summary>
## 	The prefix of the user domain (e.g., user
## 	is the prefix for user_t).
## 	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_manage_all_content', `
	git_daemon_manage_user_content($1, $2)
	git_daemon_manage_system_content($2)
')

########################################
## <summary>
##	Allow the specified domain to read
##	all Git daemon content.
## </summary>
## <param name="userdomain_prefix">
## 	<summary>
## 	The prefix of the user domain (e.g., user
## 	is the prefix for user_t).
## 	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_read_all_content', `
	git_daemon_read_user_content($1, $2)
	git_daemon_read_system_content($2)
')

########################################
## <summary>
##	Allow the specified domain to relabel
##	all Git daemon content.
## </summary>
## <param name="userdomain_prefix">
## 	<summary>
## 	The prefix of the user domain (e.g., user
## 	is the prefix for user_t).
## 	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_relabel_all_content', `
	git_daemon_relabel_user_content($1, $2)
	git_daemon_relabel_system_content($2)
')

########################################
## <summary>
##	Allow the specified domain to list
##	Git daemon system content directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_list_system_content_dirs', `
	gen_require(`
		attribute git_daemon_system_content_type;
	')

	files_search_var($1)
	list_dirs_pattern($1, git_daemon_system_content_type,
git_daemon_system_content_type)
')

########################################
## <summary>
##	Allow the specified domain to search
##	Git daemon system content directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_search_system_content_dirs', `
	gen_require(`
		attribute git_daemon_system_content_type;
	')

	files_search_var($1)
	search_dirs_pattern($1, git_daemon_system_content_type,
git_daemon_system_content_type)
')

#######################################
## <summary>
##	The template for creating a Git user domain.
## </summary>
## <desc>
##	<p>
##	This template creates a user domain, types, and
##	rules for the user's pty.
##	</p>
## </desc>
## <param name="userdomain_prefix">
##	<summary>
##	The prefix of the user domain (e.g., user
##	is the prefix for user_t).
##	</summary>
## </param>
#
template(`git_daemon_git_user_template',`
	gen_require(`
		attribute unpriv_userdomain, userdomain;
		class context contains;
	')

	##############################
	#
	# Git user public declarations.
	#

	attribute $1_file_type;
	attribute $1_usertype;

	type $1_t, userdomain, $1_usertype;
	domain_type($1_t)

	corecmd_shell_entry_type($1_t)
	corecmd_bin_entry_type($1_t)
	domain_user_exemption_target($1_t)

	role $1_r types $1_t;
	allow system_r $1_r;

	typeattribute $1_t unpriv_userdomain;
	domain_interactive_fd($1_t)

	##############################
	#
	# Git user public policy.
	#

	allow $1_usertype self:context contains;

	allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;

	corecmd_exec_bin($1_usertype)

	kernel_read_system_state($1_usertype)

	files_read_etc_files($1_usertype)

	files_search_home($1_usertype)

	git_daemon_manage_system_content($1_usertype)
	git_daemon_execute_system_content_files($1_usertype)

	libs_use_ld_so($1_usertype)
	libs_use_shared_libs($1_usertype)

	miscfiles_read_localization($1_usertype)

	ssh_rw_stream_sockets($1_usertype)

	optional_policy(` 
		nscd_read_pid($1_usertype)
	')
')

########################################
## <summary>
##	All of the rules required to administrate an 
##	Git daemon environment
## </summary>
## <param name="userdomain_prefix">
##	<summary>
##	Prefix of the domain. Example, user would be
##	the prefix for the user_t domain.
##	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed to manage the Git daemon domain.
##	</summary>
## </param>
## <rolecap/>
#
interface(`git_daemon_admin', `

	gen_require(`
		type git_daemon_t, git_daemon_exec_t, httpd_gitweb_script_exec_t;
	')

	allow $1 git_daemon_t:process { getattr ptrace signal_perms };

	git_daemon_manage_all_content($1, $2)
	git_daemon_relabel_all_content($1, $2)

	miscfiles_manage_public_files($1)

	kernel_search_proc($1)
	allow $1 git_daemon_t:dir list_dir_perms;
	read_files_pattern($1, git_daemon_t, git_daemon_t)
	read_lnk_files_pattern($1, git_daemon_t, git_daemon_t)

	manage_files_pattern($1, httpd_gitweb_script_exec_t,
httpd_gitweb_script_exec_t)
	manage_files_pattern($1, git_daemon_exec_t, git_daemon_exec_t)

	seutil_domtrans_setfiles($1)
')

#EOF

########################################
#
# Git daemon contexts
#

HOME_DIR/public_git(/.*)?
gen_context(system_u:object_r:ROLE_git_daemon_home_t, s0)

HOME_DIR/\.gitconfig   --
gen_context(system_u:object_r:ROLE_git_daemon_home_t, s0)

/srv/git(/.*)?
gen_context(system_u:object_r:git_daemon_system_content_t, s0)

/usr/bin/git-daemon            --
gen_context(system_u:object_r:git_daemon_exec_t, s0)

/var/www/git/gitweb\.cgi       --
gen_context(system_u:object_r:httpd_gitweb_script_exec_t, s0)

#EOF

But it wont work unless its modified or integrated properly. Also it
might need some polishing.

>  gitweb.fc
>  /var/www/git/gitweb.cgi --  
>  gen_context(system_u:object_r:httpd_gitweb_script_exec_t, s0)
>