{"thread":{"id":"52153","subject":"SELinux context for Git user on Fedora server?","startedAt":"2019-10-30T05:26:56Z","lastAt":"2019-10-30T06:34:50Z","messageCount":2,"participants":["Jeffrey Walton","Elijah Newren"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"385135","messageId":"CAH8yC8=uGb3J+fvkSj7-gdhqy0vtQw90K-MWQ3T1TTMQzAJnJA@mail.gmail.com","threadId":"52153","inReplyTo":null,"subject":"SELinux context for Git user on Fedora server?","fromName":"Jeffrey Walton","fromEmail":"noloader@gmail.com","sentAt":"2019-10-30T05:26:18Z","receivedAt":"2019-10-30T05:26:56Z","isPatch":false,"sender":{"key":"noloader@gmail.com","avatar":null},"body":"Hi Everyone,\n\nI'm trying to setup a Git server on Fedora 30 server with SELinux in\nenforcing mode. I am following\nhttps://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-the-Server\n.\n\nAt the push on the local machine:\n\n  $ git push -v origin master\n  Pushing to ssh://git@euclid:/var/callboot/source.git\n  Enter passphrase for key ...\n  fatal: '/var/callboot/source.git' does not appear to be a git repository\n  fatal: Could not read from remote repository.\n  ...\n\nI suspect the SELinux labels for /var/callboot/source.git are not\nquite right. Right now it looks as follows. httpd_sys_content_t is\ntypical for a web server and I think it needs to be something else.\n\n  # ls -Z /var/callboot/source.git\n  unconfined_u:object_r:httpd_sys_content_t:s0 branches\n  unconfined_u:object_r:httpd_sys_content_t:s0 config\n  unconfined_u:object_r:httpd_sys_content_t:s0 description\n  unconfined_u:object_r:httpd_sys_content_t:s0 HEAD\n  unconfined_u:object_r:httpd_sys_content_t:s0 hooks\n  unconfined_u:object_r:httpd_sys_content_t:s0 info\n  unconfined_u:object_r:httpd_sys_content_t:s0 objects\n  unconfined_u:object_r:httpd_sys_content_t:s0 refs\n\nWhat should the SELinux labels be for the Git user?\n\nThanks in advance.\n"},{"id":"385138","messageId":"CABPp-BFzAYmaQ5J0nnN9930UC5kJ1=qyvUJxL0oJNixLX3XQCQ@mail.gmail.com","threadId":"52153","inReplyTo":"CAH8yC8=uGb3J+fvkSj7-gdhqy0vtQw90K-MWQ3T1TTMQzAJnJA@mail.gmail.com","subject":"Re: SELinux context for Git user on Fedora server?","fromName":"Elijah Newren","fromEmail":"newren@gmail.com","sentAt":"2019-10-30T06:34:37Z","receivedAt":"2019-10-30T06:34:50Z","isPatch":false,"sender":{"key":"newren@gmail.com","avatar":"https://avatars.githubusercontent.com/u/5455730?v=4"},"body":"Hi,\n\nOn Tue, Oct 29, 2019 at 10:30 PM Jeffrey Walton <noloader@gmail.com> wrote:\n>\n> Hi Everyone,\n>\n> I'm trying to setup a Git server on Fedora 30 server with SELinux in\n> enforcing mode. I am following\n> https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-the-Server\n> .\n>\n> At the push on the local machine:\n>\n>   $ git push -v origin master\n>   Pushing to ssh://git@euclid:/var/callboot/source.git\n\nSo you're using ssh...\n\n>   Enter passphrase for key ...\n>   fatal: '/var/callboot/source.git' does not appear to be a git repository\n>   fatal: Could not read from remote repository.\n>   ...\n>\n> I suspect the SELinux labels for /var/callboot/source.git are not\n> quite right. Right now it looks as follows. httpd_sys_content_t is\n> typical for a web server and I think it needs to be something else.\n>\n>   # ls -Z /var/callboot/source.git\n>   unconfined_u:object_r:httpd_sys_content_t:s0 branches\n>   unconfined_u:object_r:httpd_sys_content_t:s0 config\n>   unconfined_u:object_r:httpd_sys_content_t:s0 description\n>   unconfined_u:object_r:httpd_sys_content_t:s0 HEAD\n>   unconfined_u:object_r:httpd_sys_content_t:s0 hooks\n>   unconfined_u:object_r:httpd_sys_content_t:s0 info\n>   unconfined_u:object_r:httpd_sys_content_t:s0 objects\n>   unconfined_u:object_r:httpd_sys_content_t:s0 refs\n>\n> What should the SELinux labels be for the Git user?\n\nThey should be whatever is needed to access via ssh.  I think that's\nsomething like 'ssh_home_t' (sorry, haven't fought SELinux and SSH for\na few years now), but the question isn't really anything to do with\nGit but of the combination of SELinux and SSH.\n\n\nHope that helps,\nElijah\n"}]}