gogs.te

policy_module(gogs, 1.0.0)

########################################
#
# Declarations
#

require {
        type user_home_t;
	type user_home_dir_t;
        type ssh_home_t;
	type bin_t;
	type sysctl_net_t;
	type ntop_port_t;
	type http_port_t;

	class file { map };
	class tcp_socket { name_bind name_connect };
}

type gogs_t;
type gogs_exec_t;
type gogs_home_t;
type gogs_data_t;
type gogs_conf_t;
type gogs_log_t;
init_daemon_domain(gogs_t, gogs_exec_t)

#permissive gogs_t;

########################################
#
# gogs file types
#
files_type(gogs_home_t);
files_type(gogs_data_t);
files_type(gogs_conf_t);
files_type(gogs_log_t);

########################################
#
# gogs local policy
#
allow gogs_t self:fifo_file rw_fifo_file_perms;
allow gogs_t self:unix_stream_socket create_stream_socket_perms;

domain_use_interactive_fds(gogs_t)

#files_read_etc_files(gogs_t)

auth_use_nsswitch(gogs_t)

#miscfiles_read_localization(gogs_t)

sysnet_dns_name_resolve(gogs_t)

########################################
#
# Allow network socket
allow gogs_t self:tcp_socket { accept listen };
allow gogs_t ntop_port_t:tcp_socket { name_bind name_connect };
allow gogs_t http_port_t:tcp_socket name_connect;

# Allow writing ssh keys
allow gogs_t ssh_home_t:dir rw_dir_perms;
allow gogs_t ssh_home_t:file manage_file_perms;

# Allow reading from home
allow gogs_t gogs_home_t:dir  list_dir_perms;
allow gogs_t gogs_home_t:file { rw_file_perms setattr_file_perms };

# Allow writing to data directory
allow gogs_t gogs_data_t:dir  manage_dir_perms;
allow gogs_t gogs_data_t:file { manage_file_perms map };
allow gogs_t gogs_data_t:lnk_file { create_lnk_file_perms delete_lnk_file_perms };

# Allow reading configuration
allow gogs_t gogs_conf_t:dir  list_dir_perms;
allow gogs_t gogs_conf_t:file read_file_perms;

# Allow log writing
allow gogs_t gogs_log_t:file  manage_file_perms;
allow gogs_t gogs_log_t:dir   manage_dir_perms;

# Allow creating .gitignore file in home directory...
allow gogs_t user_home_dir_t:dir { rw_dir_perms create_file_perms };
allow gogs_t user_home_dir_t:file { manage_file_perms map };

# System utilities access
allow gogs_t bin_t:file exec_file_perms;

allow gogs_t sysctl_net_t:dir list_dir_perms;
allow gogs_t sysctl_net_t:file read_file_perms;