Added basic acl handling of read/write git repos

1 files changed, 21 insertions, 3 deletions

diff --git a/src/git-run b/src/git-run
index 68d4989..bdee05c 100755
--- a/src/git-run
+++ b/src/git-run
@@ -20,6 +20,24 @@ begin
 	# extract variables from git command
 	set gitCommand $matcher[1]
 	set -l repo $matcher[2]
+	
+	# check for permissions needed
+	set -l permission
+	switch "$gitCommand"
+	    case "git-upload-pack"
+	        # allow clone/fetch/pull
+			set permission [rw]
+	    case "git-upload-archive"
+	        # allow remote archive
+			set permission [rw]
+	    case "git-receive-pack"
+	        # only allow for write users
+			set permission [w]
+	    case '*'
+			# this should not happend because we sanitize above the git command
+			echo "$(date -Is): DENY unkown_git_command user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv"
+	        exit 2
+	end
 
 	# adjust repo path to /srv/repos
 	set repoDir /(string join -n '/' srv repos (string split '/' $repo))
@@ -28,13 +46,13 @@ begin
 	set -l realPath (realpath $repoDir)
 	if not string match -r -q -- "/srv/repos/.*" "$realPath"
 		echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv"
-		exit 2
+		exit 3
 	end
 
 	# check for permissions
-	if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$"
+	if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser:$permission\$"
 		echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv"
-		exit 3
+		exit 4
 	end
 
 	# info logging