Restrict sudo to specific group

3 files changed, 6 insertions, 1 deletions

diff --git a/src/env b/src/env
index f8fcd99..2269b13 100644
--- a/src/env
+++ b/src/env
@@ -1,4 +1,5 @@
 set _REPO_PERMISSIONS_FILE /etc/repo-permissions
 set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_-]+)+.git)"
 set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$"
+set _GIT_SUDO_GROUP gitsudo
 set LOG /var/log/error.txt
diff --git a/src/init b/src/init
index 9c4107d..619c97e 100755
--- a/src/init
+++ b/src/init
@@ -31,6 +31,8 @@ function createUser
 	# user is not restricted, this is done in ssh config with forceCommand
 	# we need to be able to run a fish script to check for permissions
 	adduser --home $HOME -D "$user"
+	# add user to sudo group
+	addgroup "$user" $_GIT_SUDO_GROUP
 	# unlock account to allow ssh logins
 	passwd -u "$user"
 	mkdir "$HOME/.ssh"
@@ -45,6 +47,8 @@ function setupGitUser
 	# git user has read/write access to all repos, set git-shell
 	# and no password login allowed -> no ssh login possible
 	adduser git -u $GIT_UID -D --shell "/usr/bin/git-shell"
+	# group that is allowed to sudo
+	addgroup $_GIT_SUDO_GROUP
 end
 
 function setupRepo
diff --git a/src/sudo-git b/src/sudo-git
index 3f50291..72c3a9f 100644
--- a/src/sudo-git
+++ b/src/sudo-git
@@ -1 +1 @@
-ALL ALL=(git) NOPASSWD: /usr/bin/git-shell
+%gitsudo ALL=(git) NOPASSWD: /usr/bin/git-shell