From 8ef9b0fe88470125d6ee60a3ea0bab796048e692 Mon Sep 17 00:00:00 2001
From: Matthias Lucas Jaros <jarlucmat@mailbox.org>
Date: Mon, 20 Oct 2025 12:23:03 +0200
Subject: Security hardening

---
 src/run | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

(limited to 'src/run')

diff --git a/src/run b/src/run
index 10d69c8..5b18bc8 100755
--- a/src/run
+++ b/src/run
@@ -1,25 +1,37 @@
 #!/usr/bin/env fish
 
-set _REPO_PERMISSIONS_FILE /etc/repo-permissions
-# unify repo regex somehow
-set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '((?:\/[a-zA-Z-]+)+.git)'\$"
+# load environment
+source (dirname (status --current-filename))/env
 
 # check given git command
-set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX "$argv")
+set -l currentUser (whoami)
+set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv")
 if test (count $matcher) -ne 2
 	# there should be two groups otherwise something is wrong
+	echo "$(date -Is): DENY bad_format user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>$LOG
 	exit 1
 end
 
-# echo check for permissions
-set -l checkUser (whoami)
+# extract variables from git command
 set -l gitCommand $matcher[1]
 set -l repo $matcher[2]
+
 # adjust repo path to /srv/repos
-set -l repoDir srv repos
-set -l repoDir /(string join -n '/' $repoDir (string split '/' $repo))
-cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$checkUser\$"
-or exit 1;
+set -l repoDir /(string join -n '/' srv repos (string split '/' $repo))
+
+# check repo jail in /srv/repos
+if not string match -r -q -- "/srv/repos/.*" "(realpath $repoDir)"
+	# something is for sure wrong here
+	echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>$LOG
+	exit 2
+end
+
+# check for permissions
+if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$"
+	# something is for sure wrong here
+	echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv" &>$LOG
+	exit 1
+end
 
 # execute parsed git command
 /usr/bin/sudo -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'"
-- 
cgit v1.3.1