I was asked to run the subversion with http and svn protocols on CentOS 7 os. Installed apache and subversion. The issue arises when apache and subversion are to access the repository. Apache works with settings:

#ls -Z
drwxr-xr-x apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 repository

But in this case the svnserve can not access it. Svnserve works after setting #chcon -R -t svnserve_content_t /var/www/repository. But in this case http protocol (apache) is blocked by SELinux.

I found similar problem here: How do I get SELinux to allow Apache and Samba on the same folder?. But after more reading I chose the procedure described in CentOS wiki and created a custom SELinux policy.

The policy looks like:

module my_svnserve 1.0;

require {
    type proc_t;
    type passwd_file_t;
    type httpd_sys_rw_content_t;
    type shell_exec_t;
    type random_device_t;
    type svnserve_t;
    type http_port_t;
    type bin_t;
    class capability { fsetid dac_override };
    class tcp_socket name_connect;
    class chr_file getattr;
    class dir { search read create write getattr rmdir remove_name open add_name };
    class file { rename read lock execute_no_trans ioctl unlink open append execute setattr create write getattr };

#============= svnserve_t ==============
allow svnserve_t bin_t:file { execute execute_no_trans };
allow svnserve_t http_port_t:tcp_socket name_connect;
allow svnserve_t httpd_sys_rw_content_t:dir { search read create write getattr rmdir remove_name open add_name };
allow svnserve_t httpd_sys_rw_content_t:file { rename execute setattr read lock create getattr execute_no_trans write ioctl unlink open append };
allow svnserve_t passwd_file_t:file getattr;
allow svnserve_t passwd_file_t:file { read open };
allow svnserve_t proc_t:file getattr;
allow svnserve_t proc_t:file { read open };
allow svnserve_t random_device_t:chr_file getattr;
allow svnserve_t self:capability { fsetid dac_override };
allow svnserve_t shell_exec_t:file execute_no_trans;
allow svnserve_t shell_exec_t:file execute;

(it also consider svn hooks that connect to JIRA)

The question is: is this the right thing to do? Would it be better to create a new label and make custom policy for it? Or is using SELinux booleans better way?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.