Skip to content
Snippets Groups Projects
Commit d9ce51d3c079 authored by Robert Marshall's avatar Robert Marshall
Browse files

Generate SELinux policy module with package

- Compile the SELinux policy module files from the base type enforcement
  files during the package build
- The SELinux policy applies to more than RHEL 7, so move the type
  enforcement files out of the specific path for clarity

Closes https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8231


Signed-off-by: default avatarRobert Marshall <rmarshall@gitlab.com>
parent 201872f41658
No related branches found
No related tags found
3 merge requests!114heptapod#1394: making 1.0 the oldstable,!110heptapod#1352: merged heptapod branch into heptapod-stable,!107Merged upstream Omnibus GitLab 16.5 branching point
Showing
with 64 additions and 51 deletions
......@@ -42,7 +42,7 @@
# To be used for images that exist only on dev.gitlab.org
DEV_BUILDER_IMAGE_REGISTRY: 'dev.gitlab.org:5005/cookbooks/gitlab-omnibus-builder'
PUBLIC_BUILDER_IMAGE_REGISTRY: "registry.gitlab.com/gitlab-org/gitlab-omnibus-builder"
BUILDER_IMAGE_REVISION: "4.28.0"
BUILDER_IMAGE_REVISION: "4.30.0"
# The registry to pull the assets image from
ASSET_REGISTRY: "${CI_REGISTRY}"
ASSET_SYNC_EXISTING_REMOTE_FILES: "keep"
......
......@@ -22,6 +22,7 @@
require "#{Omnibus::Config.project_root}/lib/gitlab/util"
require "#{Omnibus::Config.project_root}/lib/gitlab/ohai_helper.rb"
require "#{Omnibus::Config.project_root}/lib/gitlab/openssl_helper"
require "#{Omnibus::Config.project_root}/files/gitlab-cookbooks/package/libraries/helpers/selinux_distro_helper.rb"
gitlab_package_name = Build::Info::Package.name
gitlab_package_file = File.join(Omnibus::Config.project_dir, 'gitlab', "#{gitlab_package_name}.rb")
......@@ -104,6 +105,7 @@
end
dependency 'cacerts'
dependency 'gitlab-selinux' if SELinuxDistroHelper.selinux_supported?
dependency 'redis'
dependency 'nginx'
dependency 'mixlib-log'
......@@ -146,7 +148,7 @@
dependency 'gitlab-psql'
dependency 'gitlab-redis-cli'
dependency 'gitlab-healthcheck'
dependency 'gitlab-selinux'
dependency 'gitlab-scripts'
dependency 'gitlab-config-template'
......
......@@ -25,4 +25,15 @@
source path: File.expand_path('files/gitlab-selinux', Omnibus::Config.project_root)
build do
policy_directory = File.expand_path('files/gitlab-selinux', Omnibus::Config.project_root)
# Only type enforcement (te) is provided in the current policy
Dir.glob("#{policy_directory}/*.te").each do |te_file|
mod_file = te_file.sub(/\.te$/, ".mod")
policy_file = te_file.sub(/\.te$/, ".pp")
command "checkmodule -M -m -o #{mod_file} #{te_file}", cwd: policy_directory
command "semodule_package -o #{policy_file} -m #{mod_file}", cwd: policy_directory
end
mkdir "#{install_dir}/embedded/selinux"
......@@ -28,3 +39,3 @@
mkdir "#{install_dir}/embedded/selinux"
sync './', "#{install_dir}/embedded/selinux/"
copy "#{policy_directory}/*.pp", "#{install_dir}/embedded/selinux"
end
......@@ -17,9 +17,9 @@
if SELinuxDistroHelper.selinux_supported?
ssh_keygen_module = 'gitlab-7.2.0-ssh-keygen'
execute "semodule -i /opt/gitlab/embedded/selinux/rhel/7/#{ssh_keygen_module}.pp" do
execute "semodule -i /opt/gitlab/embedded/selinux/#{ssh_keygen_module}.pp" do
not_if "getenforce | grep Disabled"
not_if "semodule -l | grep '^#{ssh_keygen_module}\\s'"
end
authorized_keys_module = 'gitlab-10.5.0-ssh-authorized-keys'
......@@ -21,11 +21,11 @@
not_if "getenforce | grep Disabled"
not_if "semodule -l | grep '^#{ssh_keygen_module}\\s'"
end
authorized_keys_module = 'gitlab-10.5.0-ssh-authorized-keys'
execute "semodule -i /opt/gitlab/embedded/selinux/rhel/7/#{authorized_keys_module}.pp" do
execute "semodule -i /opt/gitlab/embedded/selinux/#{authorized_keys_module}.pp" do
not_if "getenforce | grep Disabled"
not_if "semodule -l | grep '^#{authorized_keys_module}\\s'"
end
gitlab_shell_module = 'gitlab-13.5.0-gitlab-shell'
......@@ -27,9 +27,9 @@
not_if "getenforce | grep Disabled"
not_if "semodule -l | grep '^#{authorized_keys_module}\\s'"
end
gitlab_shell_module = 'gitlab-13.5.0-gitlab-shell'
execute "semodule -i /opt/gitlab/embedded/selinux/rhel/7/#{gitlab_shell_module}.pp" do
execute "semodule -i /opt/gitlab/embedded/selinux/#{gitlab_shell_module}.pp" do
not_if "getenforce | grep Disabled"
not_if "semodule -l | grep '^#{gitlab_shell_module}\\s'"
end
......
module gitlab-10.5.0-ssh-authorized-keys 1.0;
require {
type var_log_t;
type sshd_t;
type http_cache_port_t;
class tcp_socket name_connect;
class file { open read };
}
#============= sshd_t ==============
allow sshd_t http_cache_port_t:tcp_socket name_connect;
allow sshd_t var_log_t:file open;
module gitlab-13.5.0-gitlab-shell 1.1;
type gitlab_shell_t;
require {
type sshd_t;
type httpd_t;
attribute file_type;
class sock_file { write read };
class file { open read getattr };
}
typeattribute gitlab_shell_t file_type;
allow sshd_t gitlab_shell_t:file read;
allow sshd_t gitlab_shell_t:file open;
allow sshd_t gitlab_shell_t:file getattr;
allow sshd_t gitlab_shell_t:sock_file write;
allow httpd_t gitlab_shell_t:sock_file read;
allow httpd_t gitlab_shell_t:sock_file write;
module gitlab-7.2.0-ssh-keygen 1.0;
require {
type ssh_keygen_t;
type init_tmp_t;
class file open;
}
#============= ssh_keygen_t ==============
allow ssh_keygen_t init_tmp_t:file open;
File deleted
module gitlab-10.5.0-ssh-authorized-keys 1.0;
require {
type var_log_t;
type sshd_t;
type http_cache_port_t;
class tcp_socket name_connect;
class file { open read };
}
#============= sshd_t ==============
allow sshd_t http_cache_port_t:tcp_socket name_connect;
allow sshd_t var_log_t:file open;
File deleted
module gitlab-13.5.0-gitlab-shell 1.1;
type gitlab_shell_t;
require {
type sshd_t;
type httpd_t;
attribute file_type;
class sock_file { write read };
class file { open read getattr };
}
typeattribute gitlab_shell_t file_type;
allow sshd_t gitlab_shell_t:file read;
allow sshd_t gitlab_shell_t:file open;
allow sshd_t gitlab_shell_t:file getattr;
allow sshd_t gitlab_shell_t:sock_file write;
allow httpd_t gitlab_shell_t:sock_file read;
allow httpd_t gitlab_shell_t:sock_file write;
File deleted
module gitlab-7.2.0-ssh-keygen 1.0;
require {
type ssh_keygen_t;
type init_tmp_t;
class file open;
}
#============= ssh_keygen_t ==============
allow ssh_keygen_t init_tmp_t:file open;
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment