diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/env | 1 | ||||
| -rwxr-xr-x | src/git-run | 24 | ||||
| -rwxr-xr-x | src/init | 14 |
3 files changed, 33 insertions, 6 deletions
@@ -5,3 +5,4 @@ set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_\-\.]+)+.git)" set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$" set _GIT_SUDO_GROUP gitsudo set _LOG /var/log/git-run +set _PERMISSIONS r w diff --git a/src/git-run b/src/git-run index 68d4989..bdee05c 100755 --- a/src/git-run +++ b/src/git-run @@ -20,6 +20,24 @@ begin # extract variables from git command set gitCommand $matcher[1] set -l repo $matcher[2] + + # check for permissions needed + set -l permission + switch "$gitCommand" + case "git-upload-pack" + # allow clone/fetch/pull + set permission [rw] + case "git-upload-archive" + # allow remote archive + set permission [rw] + case "git-receive-pack" + # only allow for write users + set permission [w] + case '*' + # this should not happend because we sanitize above the git command + echo "$(date -Is): DENY unkown_git_command user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" + exit 2 + end # adjust repo path to /srv/repos set repoDir /(string join -n '/' srv repos (string split '/' $repo)) @@ -28,13 +46,13 @@ begin set -l realPath (realpath $repoDir) if not string match -r -q -- "/srv/repos/.*" "$realPath" echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv" - exit 2 + exit 3 end # check for permissions - if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$" + if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser:$permission\$" echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv" - exit 3 + exit 4 end # info logging @@ -54,7 +54,7 @@ end function setupRepo set -l repoConfig $argv[1] - set -l parsedConfig (string split ':' -- $repoConfig) + set -l parsedConfig (string split ';' -- $repoConfig) set -l repo $parsedConfig[1] # check repo name @@ -70,8 +70,16 @@ function setupRepo echo "Setting up repo: $repo" # write user as allowed into permission file - for user in $parsedConfig[2..] - echo "$repoDir:$user" >> $_REPO_PERMISSIONS_FILE + for userConfig in $parsedConfig[2..] + set -l parsedConfig (string split ':' -- $userConfig) + set -l user $parsedConfig[1] + set -l permission $parsedConfig[2] + + # check for valid permission + if not contains $permission $_PERMISSIONS + set permission "r" + end + echo "$repoDir:$user:$permission" >> $_REPO_PERMISSIONS_FILE end # setup repo dir |