git_session_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

💻 git_session_selinux(8) 💻

Okay bestie, so this is the manual for git_session_selinux — the SELinux policy vibe for all those git_session processes running around. Think of it as the group chat rules for keeping your git daemon besties safe and sound under Security-Enhanced Linux. Periodt. ✨

🌸 NAME 🌸

git_session_selinux — literally the Security Enhanced Linux Policy for the git_session processes. That's it, that's the name, no cap.

🦋 DESCRIPTION 🦋

Security-Enhanced Linux secures the git_session processes via flexible mandatory access control. It's giving bodyguard energy, but make it kernel-level. 💅

The git_session processes execute with the git_session_t SELinux type. Wanna check if you've got these processes running? Just run the ps command with the -Z qualifier. Slay.

For example:

ps -eZ | grep git_session_t

That's your vibe check for whether these processes are in their main character era. 👑

🚪 ENTRYPOINTS 🚪

The git_session_t SELinux type can be entered via the gitd_exec_t file type. That's the doorway, the portal, the entrance if you will. ✨

The default entrypoint paths for the git_session_t domain are the following:

/usr/libexec/git-core/git-daemon

That's it. One path. Iconic and specific. 🎯

👯 PROCESS TYPES 👯

Okay so SELinux defines process types (domains) for each process running on the system. It's like every process gets its own little personality type. No cap.

You can see the context of a process using the -Z option to ps. Bestie, this is how you peek at what's really going on.

Policy governs the access confined processes have to files. The SELinux git_session policy is very flexible — it's literally so accommodating — allowing users to setup their git_session processes in as secure a method as possible. Security but make it customizable. 💖

The following process types are defined for git_session:

  • git_session_t
Note: semanage permissive -a git_session_t can be used to make the process type git_session_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like, it's chill but the receipts are still there. 💀

🎛️ BOOLEANS 🎛️

SELinux policy is customizable based on least access required — the "give them the bare minimum" philosophy. The git_session policy is extremely flexible and has several booleans that allow you to manipulate the policy and run git_session with the tightest access possible. It's giving lock-it-down energy. 🔒✨

🌈 git_session_bind_all_unreserved_ports

If you want to determine whether Git session daemon can bind TCP sockets to all unreserved ports, you must turn on the git_session_bind_all_unreserved_ports boolean. Disabled by default. 🙈

setsebool -P git_session_bind_all_unreserved_ports 1

👑 git_session_users

If you want to determine whether calling user domains can execute Git daemon in the git_session_t domain, you must turn on the git_session_users boolean. Disabled by default. 🙈

setsebool -P git_session_users 1

🧚 fips_mode

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. Slay, it's already on. ✨

setsebool -P fips_mode 1

🍓 nis_enabled

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default. 🙈

setsebool -P nis_enabled 1

🌸 use_nfs_home_dirs

If you want to support NFS home directories, you must turn on the use_nfs_home_dirs boolean. Enabled by default. Living that NFS lifestyle already. 💖

setsebool -P use_nfs_home_dirs 1

🎀 use_samba_home_dirs

If you want to support SAMBA home directories, you must turn on the use_samba_home_dirs boolean. Disabled by default. 🙈

setsebool -P use_samba_home_dirs 1

📁 MANAGED FILES 📁

The SELinux process type git_session_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the processes UID still need to have DAC permissions — SELinux isn't gonna override your regular permissions, bestie. That's still a whole thing. 💅

🔐 krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

Look at all those paths. It's giving "let me manage ALL the kerberos cache files" energy. Obsessed. 🔥

🛠️ COMMANDS 🛠️

Okay so there's a whole toolkit of commands you can use to vibe with this policy:

  • semanage fcontext — can also be used to manipulate default file context mappings. It's how you tell things where they belong.
  • semanage permissive — can also be used to manipulate whether or not a process type is permissive. You know, the "let it slide" mode.
  • semanage module — can also be used to enable/disable/install/remove policy modules. Modular, customizable, very build-your-own-adventure.
  • semanage boolean — can also be used to manipulate the booleans. All those on/off switches from before? This is how you flip 'em.
  • system-config-selinux — is a GUI tool available to customize SELinux policy settings. For the besties who prefer a visual interface, no judgment. 🖥️✨

✍️ AUTHOR ✍️

This manual page was auto-generated using sepolicy manpage. The robots did it. 🤖💅

👀 SEE ALSO 👀

You should also check out these iconic references, fr fr:

This iconic page was brought to you by git_session from 26-10-06 — catch ya on the flip side, bestie! Stay secure, stay slay. 💅✨🔥

📦 where this page comes from