Skip to content
Snippets Groups Projects
  1. Feb 15, 2024
  2. Oct 16, 2023
  3. Sep 01, 2021
  4. Aug 27, 2021
  5. Sep 28, 2020
  6. Sep 25, 2020
  7. Sep 26, 2020
  8. May 31, 2019
  9. Jul 27, 2018
  10. Jan 19, 2018
    • Stan Hu's avatar
      Add SELinux rules to make authorized_keys via DB work on CentOS 7 · b347bc28
      Stan Hu authored
      For fast SSH key lookups to work (https://docs.gitlab.com/ee/administration/operations/fast_ssh_key_lookup.html),
      SELinux spawns `/opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check`
      and needs the following access:
      
      * Read: /var/opt/gitlab/gitlab-shell/config.yml
      * Read: /var/opt/gitlab/gitlab-rails/etc/gitlab_shell_secret
      * Write: /var/log/gitlab/gitlab-shell/gitlab-shell.log
      * Connect: unicorn (port 8080)
      
      Because the SELinux policy is a static policy, right now we don't support the
      ability to change internal unicorn ports. Admins would have to create a
      special .te file for the environment, or we'd have to dynamically generate it
      for them, which is it a bit tricky if they have changed their port contexts.
      
      Granting `http_cache_port_t` permissions also includes access to these ports:
      
      ```
      http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
      http_cache_port_t              udp      3130
      ```
      
      Closes #2855
      b347bc28
  11. Aug 25, 2014
Loading