commit 62050de32c724693fef09e9569b01287d931f83a parent a8e7d15abb6a74fd63d7c61cf4946078e40d1264 Author: Matthias Jaros <jaros@mailbox.org> Date: Sun, 26 Oct 2025 09:02:48 +0100 Redirect all output to file before git command execution where normal stdout has to be reestablished Diffstat:
| M | src/run | | | 73 | +++++++++++++++++++++++++++++++++++++++---------------------------------- |
1 file changed, 39 insertions(+), 34 deletions(-)
diff --git a/src/run b/src/run @@ -3,39 +3,43 @@ # load environment source (dirname (status --current-filename))/env -# check given git command -set -l currentUser (whoami) -set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv") -if test (count $matcher) -ne 2 - # there should be two groups otherwise something is wrong - echo "$(date -Is): DENY bad_format user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>$_LOG - exit 1 -end - -# extract variables from git command -set -l gitCommand $matcher[1] -set -l repo $matcher[2] - -# adjust repo path to /srv/repos -set -l repoDir /(string join -n '/' srv repos (string split '/' $repo)) - -# check if realPath is in jail under /srv/repos -set -l realPath (realpath $repoDir) -if not string match -r -q -- "/srv/repos/.*" "$realPath" - # something is for sure wrong here - echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" &>>$_LOG - exit 2 -end - -# check for permissions -if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$" - # something is for sure wrong here - echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>>$_LOG - exit 1 -end - -# info logging -echo "$(date -Is): ALLOW user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>>$_LOG +set -l gitCommand +set -l repoDir + +# redirect stdout/stderr to file, no information to potential attacker +begin + # check given git command + # basic form is <git-command> '<path-to-repo>' + set -l currentUser (whoami) + set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv") + if test (count $matcher) -ne 2 + echo "$(date -Is): DENY bad_format user=$currentUser ip=$SSH_CONNECTION argv=$argv" + exit 1 + end + + # extract variables from git command + set gitCommand $matcher[1] + set -l repo $matcher[2] + + # adjust repo path to /srv/repos + set repoDir /(string join -n '/' srv repos (string split '/' $repo)) + + # check if realPath is in jail under /srv/repos + set -l realPath (realpath $repoDir) + if not string match -r -q -- "/srv/repos/.*" "$realPath" + echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" + exit 2 + end + + # check for permissions + if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$" + echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv" + exit 3 + end + + # info logging + echo "$(date -Is): ALLOW user=$currentUser ip=$SSH_CONNECTION argv=$argv" +end &>>$_LOG # execute parsed git command -/usr/bin/sudo -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'" +/usr/bin/sudo -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'" +\ No newline at end of file