Added basic acl handling of read/write git repos

3 files changed, 33 insertions, 6 deletions

diff --git a/src/env b/src/env
index 8010594..4d86362 100644
--- a/src/env
+++ b/src/env
@@ -5,3 +5,4 @@ set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_\-\.]+)+.git)"
 set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$"
 set _GIT_SUDO_GROUP gitsudo
 set _LOG /var/log/git-run
+set _PERMISSIONS r w
diff --git a/src/git-run b/src/git-run
index 68d4989..bdee05c 100755
--- a/src/git-run
+++ b/src/git-run
@@ -20,6 +20,24 @@ begin
 	# extract variables from git command
 	set gitCommand $matcher[1]
 	set -l repo $matcher[2]
+	
+	# check for permissions needed
+	set -l permission
+	switch "$gitCommand"
+	    case "git-upload-pack"
+	        # allow clone/fetch/pull
+			set permission [rw]
+	    case "git-upload-archive"
+	        # allow remote archive
+			set permission [rw]
+	    case "git-receive-pack"
+	        # only allow for write users
+			set permission [w]
+	    case '*'
+			# this should not happend because we sanitize above the git command
+			echo "$(date -Is): DENY unkown_git_command user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv"
+	        exit 2
+	end
 
 	# adjust repo path to /srv/repos
 	set repoDir /(string join -n '/' srv repos (string split '/' $repo))
@@ -28,13 +46,13 @@ begin
 	set -l realPath (realpath $repoDir)
 	if not string match -r -q -- "/srv/repos/.*" "$realPath"
 		echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv"
-		exit 2
+		exit 3
 	end
 
 	# check for permissions
-	if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$"
+	if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser:$permission\$"
 		echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv"
-		exit 3
+		exit 4
 	end
 
 	# info logging
diff --git a/src/init b/src/init
index 3686332..4c7e979 100755
--- a/src/init
+++ b/src/init
@@ -54,7 +54,7 @@ end
 
 function setupRepo
 	set -l repoConfig $argv[1]
-	set -l parsedConfig (string split ':' -- $repoConfig)
+	set -l parsedConfig (string split ';' -- $repoConfig)
 	set -l repo $parsedConfig[1]
 
 	# check repo name
@@ -70,8 +70,16 @@ function setupRepo
 	echo "Setting up repo: $repo"
 
 	# write user as allowed into permission file
-	for user in $parsedConfig[2..]
-		echo "$repoDir:$user" >> $_REPO_PERMISSIONS_FILE
+	for userConfig in $parsedConfig[2..]
+		set -l parsedConfig (string split ':' -- $userConfig)
+		set -l user $parsedConfig[1]
+		set -l permission $parsedConfig[2]
+		
+		# check for valid permission
+		if not contains $permission $_PERMISSIONS
+			set permission "r"
+		end
+		echo "$repoDir:$user:$permission" >> $_REPO_PERMISSIONS_FILE
 	end
 
 	# setup repo dir