gitreef

commit 76d0570f8f07553dced5b8dd47d9e7701123a036
parent 49d94e89f15b5ff16323798a0806e2be8e208693
Author: Matthias Jaros <jaros@mailbox.org>
Date:   Mon, 20 Oct 2025 20:52:07 +0200

Restrict sudo to specific group

Diffstat:
M
src/env
 | 
1
+
M
src/init
 | 
4
++++
M
src/sudo-git
 | 
2
+-

3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/env b/src/env
@@ -1,4 +1,5 @@
 set _REPO_PERMISSIONS_FILE /etc/repo-permissions
 set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_-]+)+.git)"
 set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$"
+set _GIT_SUDO_GROUP gitsudo
 set LOG /var/log/error.txt
diff --git a/src/init b/src/init
@@ -31,6 +31,8 @@ function createUser
 	# user is not restricted, this is done in ssh config with forceCommand
 	# we need to be able to run a fish script to check for permissions
 	adduser --home $HOME -D "$user"
+	# add user to sudo group
+	addgroup "$user" $_GIT_SUDO_GROUP
 	# unlock account to allow ssh logins
 	passwd -u "$user"
 	mkdir "$HOME/.ssh"
@@ -45,6 +47,8 @@ function setupGitUser
 	# git user has read/write access to all repos, set git-shell
 	# and no password login allowed -> no ssh login possible
 	adduser git -u $GIT_UID -D --shell "/usr/bin/git-shell"
+	# group that is allowed to sudo
+	addgroup $_GIT_SUDO_GROUP
 end
 
 function setupRepo
diff --git a/src/sudo-git b/src/sudo-git
@@ -1 +1 @@
-ALL ALL=(git) NOPASSWD: /usr/bin/git-shell
+%gitsudo ALL=(git) NOPASSWD: /usr/bin/git-shell