path: root/README.SELinux

If you use SELinux, there are a few things you'll need to take care of
for cgit to work smoothly.  (Most of these should be fixed in the
official selinux-policy packages before cgit makes it into Fedora).

1. Enable the httpd_enable_cgi boolean
   $ setsebool -P httpd_enable_cgi 1

2. Set proper file contexts
   (These should be taken care of in the selinux-policy package before
   cgit makes it into stable Fedora versions.)

   a) The cache dir needs to be writable by the cgi
      # semanage fcontext -a -t httpd_sys_content_rw_t "/var/cache/cgit(/.*)?"

   b) The git repositories need to be readable by the cgi
      # semanage fcontext -a -t httpd_sys_content_t "/var/lib/git(/.*)?"

      If your git repositories are somewhere other than /var/lib/git, use that
      path in the command above.  If you have other confined daemons that need
      to access the git repositories, you may want to use public_content_t
      instead of httpd_sys_content_t.

   c) Run restorecon to update the contexts
      # restorecon -R /var/cache/cgit /var/lib/git