diff options
Diffstat (limited to 'src/git-run')
| -rwxr-xr-x | src/git-run | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/src/git-run b/src/git-run index 68d4989..bdee05c 100755 --- a/src/git-run +++ b/src/git-run @@ -20,6 +20,24 @@ begin # extract variables from git command set gitCommand $matcher[1] set -l repo $matcher[2] + + # check for permissions needed + set -l permission + switch "$gitCommand" + case "git-upload-pack" + # allow clone/fetch/pull + set permission [rw] + case "git-upload-archive" + # allow remote archive + set permission [rw] + case "git-receive-pack" + # only allow for write users + set permission [w] + case '*' + # this should not happend because we sanitize above the git command + echo "$(date -Is): DENY unkown_git_command user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" + exit 2 + end # adjust repo path to /srv/repos set repoDir /(string join -n '/' srv repos (string split '/' $repo)) @@ -28,13 +46,13 @@ begin set -l realPath (realpath $repoDir) if not string match -r -q -- "/srv/repos/.*" "$realPath" echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" - exit 2 + exit 3 end # check for permissions - if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$" + if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser:$permission\$" echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv" - exit 3 + exit 4 end # info logging |