1

I have a web server running apache under CentOS which as selinux enabled. I have a separate server which has gitlab running.

I'm trying to create a workflow using gitlab's web hooks so that when code is pushed to git, gitlab will request a page on my production server which will then pull the latest version of the code.

The script is all running fine, but selinux is not allowing git pull to run from the script. It fails with exit code 128.

Simplified PHP script

<?php 
$data = json_decode(file_get_contents("php://input"));
exec('./.hooks/received-push.sh ' . $data->repository->url);

Simplified bash script

#!/bin/sh
if [ "$#" -ne 1]; then
  echo "Repo URL must be provided"
fi
GIT=/usr/local/bin/git

TMP=mktemp
cd $TMP
$GIT clone $1 || echo "git clone failed with exit code $?"

I have already discovered that httpd_can_network_connect was set to off, so I've turned that on. If I disable selinux, everything works fine, so I know that there is something getting in the way here. The script works fine when run manually.

Looking at audit.log, I see this line appear when git clone is run (put in multiple lines here for readability)

type=AVC msg=audit(1420243675.063:1041): avc:  denied  { search } for  pid=4376 comm="ssh" name="apache" dev=dm-2 ino=133906 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
type=SYSCALL msg=audit(1420243675.063:1041): arch=c000003e syscall=2 success=no exit=-13 a0=7fff9e4e4380 a1=0 a2=1b6 a3=0 items=0 ppid=4375 pid=4376 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="ssh" exe="/usr/bin/ssh" subj=system_u:system_r:httpd_sys_script_t:s0 key=(null)

Are there any other selinux booleans which I can set to allow httpd to use ssh? Can I modify the file tags to enable it to run ssh?

Thanks :)

3

Running the AVC through audit2allow gives the following notice:

#!!!! This avc can be allowed using one of the these booleans:
#     httpd_read_user_content, httpd_enable_homedirs

In this case, httpd_read_user_content will be the appropriate one to use.


Note that it's a good idea to set SELinux to permissive so that you can collect all of the AVCs at once. This way you generally need to go through one iteration of setting booleans and possibly a custom policy, rather than several iterations.

  • That's gotten rid of that AVC but I see that there are others now. I'll take a look in more detail with audit2allow - I was unaware of that tool, thanks! – iblamefish Jan 3 '15 at 0:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.