commit 306746388f48c379b4a2ce7be4a41cd916ffa79c
parent 210240c6e7593b08a012af5c761a87d98afbd31a
Author: Matthias Jaros <jaros@mailbox.org>
Date: Sun, 19 Oct 2025 11:25:21 +0200
It works, permission check missing
Diffstat:
6 files changed, 75 insertions(+), 53 deletions(-)
diff --git a/Dockerfile b/Dockerfile
@@ -1,9 +1,16 @@
FROM alpine
-RUN apk add --no-cache openssh-server fish git
+RUN apk add --no-cache openssh-server fish git sudo
# Modified ssh conf with disabled root login and no password authentication
COPY ssh.conf /etc/ssh/sshd_config.d/
+COPY sudo-git /etc/sudoers.d/
+# required for permission check
COPY run /usr/local/bin/
RUN chmod +x /usr/local/bin/run
-ENTRYPOINT ["/usr/local/bin/run"]
+
+# required for starting
+COPY init /usr/local/bin/
+RUN chmod +x /usr/local/bin/init
+ENTRYPOINT ["/usr/local/bin/init"]
+
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -9,9 +9,9 @@ services:
restart: no
command:
- "--users"
- - test
+ - pass,yolo
- "--repos"
- - pass:test
+ - pass:pass
volumes:
- ./keys:/var/keys
- ./repos:/srv/repos
diff --git a/init b/init
@@ -0,0 +1,54 @@
+#!/usr/bin/env fish
+
+argparse 'u/users=+' 'r/repos=+' -- $argv
+or exit 1;
+
+# setup git user
+adduser git -D --shell "/usr/bin/git-shell"
+
+# create users and copy keys in correct location, set permissions
+for user in (string split ',' $_flag_u)
+ echo "Setting up user: $user"
+ if [ "$user" = git ]
+ echo "Denied because user git is reserved"
+ continue
+ end
+
+ set -l HOME "/home/$user"
+ # user is not restricted, this is done in ssh config with forceCommand
+ # we need to be able to run a fish script to check for permissions
+ adduser --home $HOME -D "$user"
+ passwd -u "$user"
+ mkdir "$HOME/.ssh"
+ cp "/var/keys/$user/authorized_keys" "$HOME/.ssh/"
+ chown -R $user "$HOME"
+ chmod -R 700 "$HOME"
+end
+
+for repoConfig in (string split ',' $_flag_r)
+ set -l parsedConfig (string split ':' $repoConfig)
+ set -l repo $parsedConfig[1]
+
+ # we assume all repos to be in /srv/repos
+ set -l repoDir "/srv/repos/$repo.git"
+ echo "Setting up repo: $repo"
+
+ # write user as allowed into permission file
+ for user in $parsedConfig[2..]
+ echo "$repo:$user" >> /srv/repos/permissions
+ end
+
+ # setup repo dir
+ if not test -d $repoDir
+ mkdir -p $repoDir
+ git init --bare $repoDir -b trunk
+ end
+ chown -R git:git "$repoDir"
+ chmod -R 700 "$repoDir"
+end
+
+echo "Setting up server"
+# generate host keys in case
+mkdir -p /var/keys/etc/ssh/ && ssh-keygen -A -f /var/keys
+# run ssh daemon
+/usr/sbin/sshd -D -e
diff --git a/run b/run
@@ -1,45 +1,8 @@
#!/usr/bin/env fish
-argparse 'u/users=+' 'r/repos=+' -- $argv
-or exit 1;
+# echo check for permissions
+set -l USER (whoami)
+#cat /srv/repos/permission | grep -E "^
-# create users and copy keys in correct location, set permissions
-for user in (string split ',' $_flag_u)
- echo "Setting up user: $user"
- set -l HOME "/home/$user"
- adduser --home $HOME -D "$user" --shell "/usr/bin/git-shell"
- passwd -u "$user"
- mkdir "$HOME/.ssh"
- cp "/var/keys/$user/authorized_keys" "$HOME/.ssh/"
- chown -R $user "$HOME"
- chmod -R 700 "$HOME"
-end
-
-for repoConfig in (string split ',' $_flag_r)
- set -l parsedConfig (string split ':' $repoConfig)
- set -l repo $parsedConfig[1]
-
- # we assume all repos to be in /srv/repos
- set -l repoDir "/srv/repos/$repo"
- echo "Setting up repo: $repo"
- addgroup "$repo"
-
- # assign groups to user
- for user in $parsedConfig[2..]
- adduser "$user" "$repo"
- id "$user"
- end
-
- # setup repo dir
- if not test -d $repoDir
- mkdir -p $repoDir
- git init --bare $repoDir -b trunk
- end
- chgrp -R "$repo" "$repoDir"
-end
-
-echo "Setting up server"
-# generate host keys in case
-mkdir -p /var/keys/etc/ssh/ && ssh-keygen -A -f /var/keys
-# run ssh daemon
-/usr/sbin/sshd -D -e
+# run command
+/usr/bin/sudo -u git /usr/bin/git-shell -c "$argv"
diff --git a/ssh.conf b/ssh.conf
@@ -10,11 +10,7 @@ SyslogFacility AUTH
LogLevel INFO
PermitTTY no
-#AllowAgentForwarding yes
+AllowAgentForwarding no
-# Example of overriding settings on a per-user basis
-#Match User anoncvs
-# X11Forwarding no
-# AllowTcpForwarding no
-# PermitTTY no
-# ForceCommand cvs server
+# Force our run script that checks for permissions and runs sudo
+ForceCommand /usr/local/bin/run "$SSH_ORIGINAL_COMMAND"
diff --git a/sudo-git b/sudo-git
@@ -0,0 +1,2 @@
+Defaults:pass !requiretty
+pass ALL=(git) NOPASSWD: /usr/bin/git-shell
