From 9e946a8a45c23a72d7a55e4ca37360ab84f963cc Mon Sep 17 00:00:00 2001 From: Matthias Lucas Jaros Date: Mon, 20 Oct 2025 20:52:07 +0200 Subject: Restrict sudo to specific group --- src/env | 1 + src/init | 4 ++++ src/sudo-git | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/env b/src/env index f8fcd99..2269b13 100644 --- a/src/env +++ b/src/env @@ -1,4 +1,5 @@ set _REPO_PERMISSIONS_FILE /etc/repo-permissions set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_-]+)+.git)" set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$" +set _GIT_SUDO_GROUP gitsudo set LOG /var/log/error.txt diff --git a/src/init b/src/init index 9c4107d..619c97e 100755 --- a/src/init +++ b/src/init @@ -31,6 +31,8 @@ function createUser # user is not restricted, this is done in ssh config with forceCommand # we need to be able to run a fish script to check for permissions adduser --home $HOME -D "$user" + # add user to sudo group + addgroup "$user" $_GIT_SUDO_GROUP # unlock account to allow ssh logins passwd -u "$user" mkdir "$HOME/.ssh" @@ -45,6 +47,8 @@ function setupGitUser # git user has read/write access to all repos, set git-shell # and no password login allowed -> no ssh login possible adduser git -u $GIT_UID -D --shell "/usr/bin/git-shell" + # group that is allowed to sudo + addgroup $_GIT_SUDO_GROUP end function setupRepo diff --git a/src/sudo-git b/src/sudo-git index 3f50291..72c3a9f 100644 --- a/src/sudo-git +++ b/src/sudo-git @@ -1 +1 @@ -ALL ALL=(git) NOPASSWD: /usr/bin/git-shell +%gitsudo ALL=(git) NOPASSWD: /usr/bin/git-shell -- cgit v1.3.1