git_system_selinux(8)

✨ git_system_selinux(8) — the SELinux glow-up for git_system ✨

okay bestie, gather round, because this is the git_system_selinux page from the SELinux Policy git_system manual and it's genuinely so important if you're messing with git daemons and mandatory access control. no cap, this is the whole vibe. 💅

---

🌸 NAME 🌸

git_system_selinux — the Security Enhanced Linux policy for the git_system processes. that's it, that's the name, iconic.

---

🦋 DESCRIPTION 🦋

Security-Enhanced Linux secures the git_system processes via flexible mandatory access control. yes, mandatory — not the gentle "pretty please" kind. SELinux is the main character here and it does not negotiate. 👑

The git_system processes execute with the git_system_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier. like this, literally:

ps -eZ | grep git_system_t

run that and see what's up. if something pops up with git_system_t, congrats, you found the vibe. 🎀

---

🧚 ENTRYPOINTS 🧚

so the git_system_t SELinux type can be entered via the gitd_exec_t file type. that's the doorway. the only doorway. respect it. 🚪✨

the default entrypoint paths for the git_system_t domain are the following, and yes i'm giving you the exact path because precision is the moment:

/usr/libexec/git-core/git-daemon

---

🌈 PROCESS TYPES 🌈

SELinux defines process types (aka domains) for each process running on the system. every process gets a little label, it's giving personalized name tags at a party. 🎉

you can see the context of a process using the -Z option to ps. (yes, same -Z as before, she's consistent, we love her.)

policy governs the access confined processes have to files. the SELinux git_system policy is very flexible — allowing users to setup their git_system processes in as secure a method as possible. flexible and secure? we stan. 💖

the following process types are defined for git_system:

• git_system_t

note: semanage permissive -a git_system_t can be used to make the process type git_system_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, she won't block you, but she will be watching and taking notes. 👀

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. the git_system policy is extremely flexible and has several booleans that allow you to manipulate the policy and run git_system with the tightest access possible. it's giving "customize your own adventure." 🗺️✨

• git_system_enable_homedirs — turn this on if you want to determine whether the Git system daemon can search home directories. Disabled by default.

setsebool -P git_system_enable_homedirs 1

• git_system_use_cifs — turn this on if you want to determine whether the Git system daemon can access cifs file systems. Disabled by default.

setsebool -P git_system_use_cifs 1

• git_system_use_nfs — turn this on if you want to determine whether the Git system daemon can access nfs file systems. Disabled by default.

setsebool -P git_system_use_nfs 1

• daemons_dontaudit_scheduling — turn this on if you want to dontaudit all daemons scheduling requests (setsched, sys_nice). Enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

• fips_mode — turn this on if you want to allow all domains to execute in fips_mode. Enabled by default.

setsebool -P fips_mode 1

• nis_enabled — turn this on if you want to allow system to run with NIS. Disabled by default.

setsebool -P nis_enabled 1

• use_nfs_home_dirs — turn this on if you want to support NFS home directories. Enabled by default.

setsebool -P use_nfs_home_dirs 1

• use_samba_home_dirs — turn this on if you want to support SAMBA home directories. Disabled by default.

setsebool -P use_samba_home_dirs 1

---

💜 MANAGED FILES 💜

the SELinux process type git_system_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. and babes, note the processes UID still need to have DAC permissions — SELinux isn't doing everything for you, she's not your personal assistant. 😭

• cluster_conf_t

/etc/cluster(/.*)?

• cluster_var_lib_t

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

• cluster_var_run_t

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

• krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

• root_t

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

---

🔥 COMMANDS 🔥

there are a bunch of tools that do the same thing, so use whichever one is your fave. no gatekeeping here.

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. it's giving "for the girls who prefer a little interface with their policy." 🖱️💖

---

⭐ AUTHOR ⭐

this manual page was auto-generated using sepolicy manpage. so nobody hand-wrote this, the machines did it, and honestly they ate. 🤖✨

---

💀 SEE ALSO 💀

selinux(8), git_system(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8). go read those too if you want the full lore. iykyk. 📚

---

and that's the whole page bestie! til we meet again: git_system, version date 26-10-06, from the SELinux Policy git_system manual. stan a secure daemon. periodt. 💅🫶🌸