>From 970120e458e784396d57279b85fce7382b975929 Mon Sep 17 00:00:00 2001 From: Luke Macken Date: Fri, 21 Nov 2008 15:17:30 +0000 Subject: [PATCH] Create a custom SELinux policy module for hosted, and enable the rsync_export_all_ro boolean. diff --git a/configs/system/selinux/modules/hosted.pp b/configs/system/selinux/modules/hosted.pp new file mode 100644 index 0000000000000000000000000000000000000000..36f27ed44d9dfdc786366be0031e277fb9a0b012 GIT binary patch literal 23544 zcmeI4S(6;OamVTPO<%I)`%=lYrKUX`aV3Wz^x|2GVt6CGM~GU#I2;`{Rp{yRR9E%Z zF~e~2jBoc|t1du@0f4%sR|NVt~_wIe5 z_P3Gx?OdH-(ZYSje7ST@`Ad2N z=(K9eU)Aq#Di&?ixMBd1;-Yi;;2`H06)(GLaMXZe5T3ev*0l@D=}6TUL;dS|_yffz zU$`l#e_IJ?jdbMYva2pY^GB;(!%U;!Q0zt9(9#Co?Obs&RS!u2ekdgk#WZ~8hI|-0 zk|5}Pl1CcOi^46fI}Czg+vPyV;J^A-0{1mVRZ|IV{4S~aIF#*WL;CBA&_GA2Nkg?5 zOh1W%4?_#8-=eV65H_&+4;9zFCWinae;Oj`p;(3y1H&B*4=51?&kOni-4GW>duVr$ zAmBEFZRv*;9@yZyOHe@fAqEZsg>xoaf%bz8CXEni9B#&;lo);qbKpnbOYJIY3*0~( z*1AKENjR{`)Yw$drIER*9imvee(2gO@StdkOw)9bX&xD>zvXPd~E!qn= zWiV+7n55qz2>p&)n3ttNllGQjnRl+)&}WoT`N9hlZ!_|)m_r{eZPi{1Q2j+aHbdKx z#4da}wnN^Ugrm3pWxj09EGS_eqz;jATAxp6Rc*~OBHqj%f~UI~NXJuyw`R~AX9?YA zY~n;!%)7V55-35;Bp}_@vaOn7He9c|HWN4V%Wh#rY!x~2Os+?Kx z?KnmmVN%w)yYhJ}(^#EV%^ZusgkD}rTO_X4P_?#%p*QOs%mq{1tnJQenYPrSUi}O3 zXi(GU$`Uzd*QukPoL6;C$7ol{W~^5$MUmCj)uJ*5MVi7iKwl9sT2Nv&x|9mWoNzE;W|wP2oVxWDcHw$o*=L6_F<-aD-t5yH*jn3W7Bsj;`Ify}>AWXOqxrD$-r{v>Bsx0lm)w3&^Htcce}ytsgT zkgnFA5Cwo$tZcec$^TEkhnl`CHn)ZMxi-0l`VHrSRWHC6d(L7MNDVvwL-ussFQ;QQF6OAm>+1+k) zVGPD{yBFf;%Kk9Iguhi}B!~pf?(~zSpRnKwz_ul1lwr_C@-Oa!_`!7>se)o7nEq`oN8$XHpUj9 zyj)ba^|sxTGUP%N9>`*=0f^jFIzpn7ZHJY^@~&lF#>8Fb#Z;cvuB%D|!m!DAG&TC5 zl<{Iejt2s5paQeK)_+X%AU3b55Nlsr3~X~i4z;IUo0mo24`9W3Sf-A7RJpsT3iD84 z=^(TTX?DrRfXe%1F-bGAuQKNbinut}`ZlgzRFdr2l^Q)DK8)Jsz4Z#BXxsP&A(&Wy z{$JtzFPkM?DB0Y>APp>=`rC*F&z@Wk?9WJem; zw@4b#F^!*Ai=x5VE{OHdY8ONTFgpy_@d^_w)srhg6ti<$pB0g!LpKg{42Kr5QPAzY z9a!J-Rg!h-*jN%f#SpAcJ6IVL{!($vwU z*ze!o%+)f)KQfwMg1o=)t)%UdU!TV)I03=N{1FM7oT?ed&g|bEAH!f4uN}ic#p)P_ zeJg>jdK3lH{wVpqB)lO>i1Xtkv6j;lB0(qqy4o>lg~I$q?qZQIr~mG{HhLIwdoZmL z3A!%Gj0h~}XzN+8aMgu*CV*nrXTuaXO?EK%4(?VDvKoTfgolc$63HP@>o`mo`rhA} z5NqDRg=lt}1k^GW?{G5xUcm3>9(r_weMf9ZqlkpKxDWTXFj;c6;{9~b%`FzKl)s7Z zSLgl~JhKpJmTkSrhhmN+n}7>6)uFhNd#^!a%p1_4IIZA^X3ilJdcS33I*Frtm`mtP zjS#UutYVu+fYeml{KgW&L9B49SGqicY$8}H<#q^15Xcf0Lzd*RZ@tsrB-8_H`xw__ zpaV@5bGvt_GaB$vqi7dPPFOWtpSlhk1e;>6F64DULPX5-7boZ%ZAd4=H5Zm!P^O!R za*qW?;fR2yQ62I-_a%!0vSCHU8FsET4Zj4fqoJCLEF){3s7$3yRdGcYO$$Oj(e?Ix zL6TlZT=@mm5+gf)HAC#%pJ5ice2$T^{?63cmK9d7)i4j+< zd!oD;`gyLGXr=>w1a=#Y_%qg-^~9&Focs3BRqW| zoY-Ig=jJo%2p@mROY@Nt0xRv45F_l1(8xyqix>YO&<%JrkZ=;>3eSrdKiirg8sCKX zm^SmR*$w=$olSUOvYCGy{@dVRHh(*v8e!w;COyWUjeZ5TZRUp#Z{WG-!$!Uzu1!2I zo&UmG-W&fdbVixmz;l~C+?Ia}e(~8Dv4Q`k^KTu;TkzisZ#~$bp6z&U*RSpHK}|Qt z{hLPprk?)nmi*iJ8Q5?5L)ANZj<{d<7aPZVIj)h@7kBAPjLiP)7er$&zsxGUf0*Vm zw0fs6&0>O%@1@<$k1uDX`JmAHEX@K%e6c6Z$AE;lThi!Z~*`m})laz=48k5lwCFXd`_>o|p>lk%3PS!`V5U|he)nnJNs*}PbpLZr>7m-|u} zn%8Z!G%IcX`i-s>3Tas1LrP21X49)CDGZCtEW^3TBJfcsiUGu&LiT zB257}?28R-J=jZu>E`-4DlNes8_^`EJhy=)#||k7_}9+zw1hRG@K>`mla>E9r)pXV zuC*&LEn$?UplKGsYj<8+!usr{&nYcu=aPC#(lW+1Zv3>JPm9>xM1F1Rn#rNNCWol1 z-xs84umEvqmFA=Bl*Jtg=~!-c>^yOL%^=aJm4)3wgy$Fb+m0a3MCUel0V#w4ERY8Y zeg_aC$RQTCFNnD`wRP41-}+#~{nrf-?mx($=u%5DwB1#<)U|roHGMXbaejE8!q3^- zX>Zx}KTzt!3xY zRzecVH${`7-h-U`#)D^9i&J*J8FzpZisD>zSgK&r_zb>1PRH zt9j{dQs&jTPsk$2?&}9NVRUEEUtPE zPuWv65B2cxgxgEDE0&o`1WPgT*5F7w4){^yF73CdW#=cZe+cag3skIQj`Gg z84TMedC|3frWd=i{<4x&t7^`&Q#V{X*JS?MYvx^5YC3Pq4CfX1YC~@3?dpTy&6|O&&b_!CnM^EQ7E9&c;D6OD8mE{k$FPQjDiBD;9g+_Qo=CW?73r z6YSMdr~BZ&7m7XD{Tj`#_`1>VULF1{j6;-`x!5WGo$WiqPna@wKVE#9WtT4Ui9v^v zrJLnrEqTd?u`#K<$m`K%d7t%5S5&h~rv3EFU{_Ks*%LCV$4m2>ueBZo;V<_k@yE}3 z!+gl_@H)LppXm*std*cNh>z}$^Q!!@Nc`zsLen@`_DHCPT6bXeUcD&n+XPg@okGj|lr$M!^qGXzF7nPYrui9TR&9B*N{jq`4$3`ZfdS&5Q+x1!@yw*Xk1ZHTmQf+4V#9Q5!n6 zGDCgCQqueY^wHLgbWVg?*x8$;P;AuyXMR~3R$zXas-sfoSMP(!Y>BL9S*KkWt}x@; z9yLtuZKDOD%?fGl8+9|;oY>$ato)S-VFI?=GEPqOvKEOc3QxdyWhxUIG+8s{eN@-U z<{dhXq(HdwC4x0=^Ju-#Pr=qR*r&kwE!cK|C%XzEChQsl0Uona`XnE6UU}Gr$bva| zX7878mWSdm8b0-?UC)`VYIx&nH9(rWi+a?a(cD@`S_#>^Ku0n}z&(7~$pi67cP~LK z68^(llcLYpM#n@*SJVfav)G^U354oYcLw4r0mL_Jcv~Io?1JP{!wSwMOA=IRyR%O- zu`)vP@=a39zt{!=vVzD*q;*TDw7@wRHn<&q*dJkgswK2GJYR*8 ztH|hqyd!dV@L{tZ^0NY#+G-c0d&^W+|JaQN)4ij*r~a8=4*YZW@#jCX`OYr|WS#d6 zHcp?q%Vc(CmbN7%bLW%j8&9y4|5OGr$ucxwXu~$aw3s&8tK)LBo0mbHFleei^Mc}Q z?@6ZWspdX(u1*FbC-|lEHK+Xq6B$>r38c|?&6z%lCio^apxeCMI-9uW-A=H3Le`Z6 zC$b3!VdZyDE6~V>Z&)p)KH(JJx3JZ3t6HhQ_C~Ee$H6#hd!M|%O=Mn03?eoE2N2ff AiU0rr literal 0 HcmV?d00001 diff --git a/configs/system/selinux/modules/hosted.te b/configs/system/selinux/modules/hosted.te new file mode 100644 index 0000000..2d0a8df --- /dev/null +++ b/configs/system/selinux/modules/hosted.te @@ -0,0 +1,8 @@ +policy_module(hosted,1.0.0) + +require { + type httpd_sys_script_t; +} + +#============= httpd_sys_script_t ============== +auth_getattr_shadow(httpd_sys_script_t) diff --git a/manifests/servergroups/hosted.pp b/manifests/servergroups/hosted.pp index 0172046..81548c2 100644 --- a/manifests/servergroups/hosted.pp +++ b/manifests/servergroups/hosted.pp @@ -74,4 +74,11 @@ class hosted { semodule { 'git': } + semodule { 'hosted': + } + + selinux_bool { 'rsync_export_all_ro': + bool => 'on' + } + } -- 1.5.5.1