git_client_exec_user_bin tunable

git may under some circumstances want to run user binaries (e.g.,
git-bisect and custom git commands).

Add a tunable to allow git to execute such user binaries.

Signed-off-by: Antonio Enrico Russo <[email protected]>

Author: aerusso

policy/modules/services/git.te

@@ -88,6 +88,14 @@ gen_tunable(git_system_use_nfs, false)
 ## </desc>
 gen_tunable(git_client_manage_all_user_home_content, false)
 
+## <desc>
+##	<p>
+##	Determine whether Git client domains
+##	can run user binaries.
+##	</p>
+## </desc>
+gen_tunable(git_client_exec_user_bin, false)
+
 attribute git_daemon;
 attribute_role git_session_roles;
 
@@ -347,3 +355,7 @@ tunable_policy(`git_client_manage_all_user_home_content',`
 	userdom_manage_all_user_home_content(git_client_domain)
 	userdom_map_all_user_home_content_files(git_client_domain)
 ')
+
+tunable_policy(`git_client_exec_user_bin',`
+	userdom_exec_user_bin_files(git_client_domain)
+')