diff options
Diffstat (limited to 'src/run')
| -rwxr-xr-x | src/run | 62 |
1 files changed, 33 insertions, 29 deletions
@@ -3,39 +3,43 @@ # load environment source (dirname (status --current-filename))/env -# check given git command -set -l currentUser (whoami) -set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv") -if test (count $matcher) -ne 2 - # there should be two groups otherwise something is wrong - echo "$(date -Is): DENY bad_format user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>$_LOG - exit 1 -end +set -l gitCommand +set -l repoDir -# extract variables from git command -set -l gitCommand $matcher[1] -set -l repo $matcher[2] +# redirect stdout/stderr to file, no information to potential attacker +begin + # check given git command + # basic form is <git-command> '<path-to-repo>' + set -l currentUser (whoami) + set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv") + if test (count $matcher) -ne 2 + echo "$(date -Is): DENY bad_format user=$currentUser ip=$SSH_CONNECTION argv=$argv" + exit 1 + end -# adjust repo path to /srv/repos -set -l repoDir /(string join -n '/' srv repos (string split '/' $repo)) + # extract variables from git command + set gitCommand $matcher[1] + set -l repo $matcher[2] -# check if realPath is in jail under /srv/repos -set -l realPath (realpath $repoDir) -if not string match -r -q -- "/srv/repos/.*" "$realPath" - # something is for sure wrong here - echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" &>>$_LOG - exit 2 -end + # adjust repo path to /srv/repos + set repoDir /(string join -n '/' srv repos (string split '/' $repo)) -# check for permissions -if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$" - # something is for sure wrong here - echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>>$_LOG - exit 1 -end + # check if realPath is in jail under /srv/repos + set -l realPath (realpath $repoDir) + if not string match -r -q -- "/srv/repos/.*" "$realPath" + echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" + exit 2 + end -# info logging -echo "$(date -Is): ALLOW user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>>$_LOG + # check for permissions + if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$" + echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv" + exit 3 + end + + # info logging + echo "$(date -Is): ALLOW user=$currentUser ip=$SSH_CONNECTION argv=$argv" +end &>>$_LOG # execute parsed git command -/usr/bin/sudo -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'" +/usr/bin/sudo -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'"
\ No newline at end of file |