Skip to content

Commit 9ad7415

Browse files
balasankarcrmarshall-gitlab
balasankarc
and
rmarshall-gitlab
committed
Merge branch '7453-consolidate-selinux-policy' into 'master'
Consolidate SELinux policy into one module Closes #7453 and #8235 See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7295 Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com> Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com> Approved-by: Jason Plum <jplum@gitlab.com> Reviewed-by: Balasankar 'Balu' C <balasankar@gitlab.com> Co-authored-by: Robert Marshall <rmarshall@gitlab.com>
2 parents 3500a7f + 362ebe5 commit 9ad7415

File tree

6 files changed

+104
-14
lines changed

6 files changed

+104
-14
lines changed

‎files/gitlab-config-template/gitlab.rb.template‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2799,6 +2799,11 @@ external_url 'GENERATED_EXTERNAL_URL'
27992799
# package['generate_default_secrets'] = true
28002800
##! Set to false to prevent creating the default `gitlab-secrets.json` file
28012801
# package['generate_secrets_json_file'] = true
2802+
2803+
##! Settings to control SELinux policy
2804+
##! Experimental. Set to 1.0 to switch from legacy multiple policy modules to
2805+
##! newer single `gitlab` SELinux policy module.
2806+
# package['selinux_policy_version'] = nil
28022807
################################################################################
28032808
################################################################################
28042809
## Configuration Settings for GitLab EE only ##

‎files/gitlab-cookbooks/gitlab/recipes/selinux.rb‎

Lines changed: 42 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,50 @@
1717

1818
if SELinuxDistroHelper.selinux_supported?
1919
ssh_keygen_module = 'gitlab-7.2.0-ssh-keygen'
20-
execute "semodule -i /opt/gitlab/embedded/selinux/#{ssh_keygen_module}.pp" do
21-
not_if "getenforce | grep Disabled"
22-
not_if "semodule -l | grep '^#{ssh_keygen_module}\\s'"
23-
end
24-
2520
authorized_keys_module = 'gitlab-10.5.0-ssh-authorized-keys'
26-
execute "semodule -i /opt/gitlab/embedded/selinux/#{authorized_keys_module}.pp" do
27-
not_if "getenforce | grep Disabled"
28-
not_if "semodule -l | grep '^#{authorized_keys_module}\\s'"
29-
end
30-
3121
gitlab_shell_module = 'gitlab-13.5.0-gitlab-shell'
32-
execute "semodule -i /opt/gitlab/embedded/selinux/#{gitlab_shell_module}.pp" do
33-
not_if "getenforce | grep Disabled"
34-
not_if "semodule -l | grep '^#{gitlab_shell_module}\\s'"
22+
gitlab_unified_module = 'gitlab'
23+
24+
if SELinuxHelper.use_unified_policy?(node)
25+
execute "semodule -i /opt/gitlab/embedded/selinux/#{gitlab_unified_module}.pp" do
26+
not_if "getenforce | grep Disabled"
27+
not_if "semodule -l | grep -E '^#{gitlab_unified_module}([[:space:]]|$)'"
28+
end
29+
30+
execute "semodule -r #{ssh_keygen_module}" do
31+
not_if "getenforce | grep Disabled"
32+
only_if "semodule -l | grep -E '^#{ssh_keygen_module}([[:space:]]|$)'"
33+
end
34+
35+
execute "semodule -r #{authorized_keys_module}" do
36+
not_if "getenforce | grep Disabled"
37+
only_if "semodule -l | grep -E '^#{authorized_keys_module}([[:space:]]|$)'"
38+
end
39+
40+
execute "semodule -r #{gitlab_shell_module}" do
41+
not_if "getenforce | grep Disabled"
42+
only_if "semodule -l | grep -E '^#{gitlab_shell_module}([[:space:]]|$)'"
43+
end
44+
else
45+
execute "semodule -i /opt/gitlab/embedded/selinux/#{ssh_keygen_module}.pp" do
46+
not_if "getenforce | grep Disabled"
47+
not_if "semodule -l | grep -E '^#{ssh_keygen_module}([[:space:]]|$)'"
48+
end
49+
50+
execute "semodule -i /opt/gitlab/embedded/selinux/#{authorized_keys_module}.pp" do
51+
not_if "getenforce | grep Disabled"
52+
not_if "semodule -l | grep -E '^#{authorized_keys_module}([[:space:]]|$)'"
53+
end
54+
55+
execute "semodule -i /opt/gitlab/embedded/selinux/#{gitlab_shell_module}.pp" do
56+
not_if "getenforce | grep Disabled"
57+
not_if "semodule -l | grep -E '^#{gitlab_shell_module}([[:space:]]|$)'"
58+
end
59+
60+
execute "semodule -r #{gitlab_unified_module}" do
61+
not_if "getenforce | grep Disabled"
62+
only_if "semodule -l | grep -E '^#{gitlab_unified_module}([[:space:]]|$)'"
63+
end
3564
end
3665
end
3766

‎files/gitlab-cookbooks/package/attributes/default.rb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,6 @@
4040
default['runit']['service_dir'] = '/opt/gitlab/service'
4141
default['runit']['sv_dir'] = '/opt/gitlab/sv'
4242
default['runit']['lsb_init_dir'] = '/opt/gitlab/init'
43+
44+
# SELinux Policy options to assist with transition to unified policy
45+
default['package']['selinux_policy_version'] = nil

‎files/gitlab-cookbooks/package/libraries/helpers/selinux_helper.rb‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ class SELinuxHelper
44
class << self
55
include ShellOutHelper
66

7+
def use_unified_policy?(node)
8+
return false if node['package']['selinux_policy_version'].nil?
9+
10+
true
11+
end
12+
713
def commands(node)
814
ssh_dir = File.join(node['gitlab']['user']['home'], ".ssh")
915
authorized_keys = node['gitlab']['gitlab_shell']['auth_file']

‎files/gitlab-selinux/gitlab.te‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
module gitlab 1.0.0;
2+
3+
############################
4+
# External policy components
5+
############################
6+
require {
7+
type http_cache_port_t;
8+
type httpd_t;
9+
type init_tmp_t;
10+
type ssh_keygen_t;
11+
type sshd_t;
12+
type sshd_t;
13+
type var_log_t;
14+
15+
attribute file_type;
16+
17+
class file { open read getattr };
18+
class sock_file { write read };
19+
class tcp_socket name_connect;
20+
}
21+
22+
################################
23+
# GitLab policy type definitions
24+
################################
25+
type gitlab_shell_t;
26+
27+
typeattribute gitlab_shell_t file_type;
28+
29+
#####################
30+
# Access Vector Rules
31+
#####################
32+
allow ssh_keygen_t init_tmp_t:file open;
33+
34+
allow sshd_t http_cache_port_t:tcp_socket name_connect;
35+
allow sshd_t var_log_t:file open;
36+
allow sshd_t gitlab_shell_t:file { read open getattr };
37+
allow sshd_t gitlab_shell_t:sock_file write;
38+
39+
allow httpd_t gitlab_shell_t:sock_file { read write };

‎spec/chef_helper.rb‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,19 @@ def deep_clone(obj)
5050
end
5151

5252
config.before(:each, type: :chef) do
53+
ssh_keygen_module = 'gitlab-7.2.0-ssh-keygen'
54+
authorized_keys_module = 'gitlab-10.5.0-ssh-authorized-keys'
55+
gitlab_shell_module = 'gitlab-13.5.0-gitlab-shell'
56+
gitlab_unified_module = 'gitlab'
57+
5358
stub_command('id -Z').and_return(false)
5459
stub_command("grep 'CS:123456:respawn:/opt/gitlab/embedded/bin/runsvdir-start' /etc/inittab").and_return('')
5560
stub_command(%r{\(test -f /var/opt/gitlab/gitlab-rails/upgrade-status/db-migrate-\h+-\) && \(cat /var/opt/gitlab/gitlab-rails/upgrade-status/db-migrate-\h+- | grep -Fx 0\)}).and_return(false)
5661
stub_command("getenforce | grep Disabled").and_return(true)
57-
stub_command("semodule -l | grep '^#gitlab-7.2.0-ssh-keygen\\s'").and_return(true)
62+
stub_command("semodule -l | grep '^#{ssh_keygen_module}([[:space:]]|$)'").and_return(true)
63+
stub_command("semodule -l | grep '^#{authorized_keys_module}([[:space:]]|$)'").and_return(true)
64+
stub_command("semodule -l | grep '^#{gitlab_shell_module}([[:space:]]|$)'").and_return(true)
65+
stub_command("semodule -l | grep -E '^#{gitlab_unified_module}([[:space:]]|$)'").and_return(true)
5866
stub_command(%r{set \-x \&\& \[ \-d "[^"]\" \]}).and_return(false)
5967
stub_command(%r{set \-x \&\& \[ "\$\(stat \-\-printf='[^']*' \$\(readlink -f /[^\)]*\)\) }).and_return(false)
6068
stub_command('/opt/gitlab/embedded/bin/psql --version').and_return("fake_version")

0 commit comments

Comments
 (0)