{"thread":{"id":"1222","subject":"\"git daemon\"","startedAt":"2005-07-14T02:53:46Z","lastAt":"2005-07-16T03:04:03Z","messageCount":4,"participants":["Linus Torvalds","H. Peter Anvin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"6102","messageId":"Pine.LNX.4.58.0507131946540.17536@g5.osdl.org","threadId":"1222","inReplyTo":null,"subject":"\"git daemon\"","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-07-14T02:53:46Z","receivedAt":"2005-07-14T02:53:46Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\nGuys,\n I've written a really simple TCP git daemon that normally listens on \nport \"DEFAULT_GIT_PORT\" aka 9418. It waits for a connection, and will just \nexecute \"git-upload-pack\" when it gets one.\n\nIt's actually a bit more careful than that, in that there's a magic \nrequest-line that gives the command and what directory to upload, and it \nverifies that the directory is ok.\n\nIn particular, it verifies that the directory has the magic file\n\"git-daemon-export-ok\", and it will refuse to export any git directory \nthat hasn't explicitly been marked for export this way.\n\nWhat I'd ask people to check is how comfortable for example kernel.org \nwould be to have one machine that runs this kind of service? I've tried \nvery hard to set it up so that it doesn't have any security issues: the \ndaemon can be run as \"nobody\", and it shouldn't ever even write to any \nfiles, although I guess we should do a full check of that.\n\nIn fact, it doesn't even really accept any user input except for the list\nof SHA1's that you give the upload which denote the \"I have these\" list. \nSo I really think it should be hard to fool into doing anything bad, and \nthe code isn't _that_ complicated, but hey, it's a daemon. They're always \nbuggy, and there are always security issues.\n\nAnyway, this would be a _wonderful_ interface for read-only updates, ie \npeople pulling from my (and other peoples) git repositories.\n\n\t\tLinus\n"},{"id":"6103","messageId":"Pine.LNX.4.58.0507131956580.17536@g5.osdl.org","threadId":"1222","inReplyTo":"Pine.LNX.4.58.0507131946540.17536@g5.osdl.org","subject":"Re: \"git daemon\"","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-07-14T03:11:02Z","receivedAt":"2005-07-14T03:11:02Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Wed, 13 Jul 2005, Linus Torvalds wrote:\n> \n> Anyway, this would be a _wonderful_ interface for read-only updates, ie \n> people pulling from my (and other peoples) git repositories.\n\nI guess I should say what the interface is, so that people don't have to \nread the sources to find out..\n\nOn the server side:\n\n\t# mark all repositories you want to export with the\n\t# \"git-daemon-export-ok\" file in the .git directory..\n\t#\n\t# .. and let the port (9418) through any firewalls etc,\n\t# of course\n\n\tgit-daemon >& logfile &\n\n(NOTE! \"git-daemon\" will not disassociate from any tty's or anything fancy \nlike that.)\n\nOn the client side:\n\n\tgit pull git://servername/pub/scm/linux/kernel/git/torvalds/linux-2.6.git\n\nAnd you're done.\n\n(or \"git clone\", for that matter - I just fixed a one-liner that caused\n\"clone\" to not work, so make sure that you have a commit that says 'Fix\nthe \"close before dup\" bug in clone-pack too').\n\nIf you want to use a different port number (maybe 9418 is some really 133t \nport, and google just doesn't know about it), you can give git-daemon a \n\"--port=x\" command line argument, and you can use\n\n\tgit://servername:port/pathname\n\non the client side. At least that was my intention, I didn't actually test \nwhether that worked (but the default port has been tested).\n\n\t\t\tLinus\n"},{"id":"6180","messageId":"42D86B92.7010303@zytor.com","threadId":"1222","inReplyTo":"Pine.LNX.4.58.0507131946540.17536@g5.osdl.org","subject":"Re: \"git daemon\"","fromName":"H. Peter Anvin","fromEmail":"hpa@zytor.com","sentAt":"2005-07-16T02:06:10Z","receivedAt":"2005-07-16T02:06:10Z","isPatch":false,"sender":{"key":"hpa@zytor.com","avatar":null},"body":"Linus Torvalds wrote:\n> \n> What I'd ask people to check is how comfortable for example kernel.org \n> would be to have one machine that runs this kind of service? I've tried \n> very hard to set it up so that it doesn't have any security issues: the \n> daemon can be run as \"nobody\", and it shouldn't ever even write to any \n> files, although I guess we should do a full check of that.\n> \n\nSince it can be run as a sequestered user, and we now have plenty of CPU \nhorsepower on the download servers, it seems like it should be an \nentirely sane thing to do.\n\nIs this thing meant to be run from inetd, or is it a \"listen and fork\" \ndaemon?  Especially the latter case, it absolutely *have* to have \nprotections for:\n\n- \"SYN and run\" DoS attacks;\n- Too many connections from the same IP;\n- Too many processes running total.\n\n\t-hpa\n"},{"id":"6181","messageId":"Pine.LNX.4.58.0507151945370.19183@g5.osdl.org","threadId":"1222","inReplyTo":"42D86B92.7010303@zytor.com","subject":"Re: \"git daemon\"","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-07-16T03:04:03Z","receivedAt":"2005-07-16T03:04:03Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Fri, 15 Jul 2005, H. Peter Anvin wrote:\n> \n> Since it can be run as a sequestered user, and we now have plenty of CPU \n> horsepower on the download servers, it seems like it should be an \n> entirely sane thing to do.\n\nGoodie.\n\n> Is this thing meant to be run from inetd, or is it a \"listen and fork\" \n> daemon?\n\nIt can do both, now (since earlier today). Use the \"--inetd\" flag if you\nrun it from something like inetd that will have done the accept/fork for\nit. In that case the \"--port=xxx\" argument obviously doesn't make any\nsense.\n\nThere are \"git-core-0.99.1\" rpm (src, x86, ppc64 as usual) at\n\n\thttp://www.kernel.org/pub/software/scm/git/\n\nwhich are new enough that they already have the --inetd flag support.\n\n> \t\tEspecially the latter case, it absolutely *have* to have \n> protections for:\n> \n> - \"SYN and run\" DoS attacks;\n> - Too many connections from the same IP;\n> - Too many processes running total.\n\nDo you prefer just relying on inetd, or should I extend the server? inetd \nobviously involves an extra execve(), but on the other hand, it's a very \nvery small program, so it's not like it's a huge expense (it does some \nvery trivial parsing, and then it ends up executing \"git-upload-pack\").\n\nRight now you're right - you definitely want to use inetd. I just realized\nthat my built-in server leaves zombies around, for example.\n\nOn the security front:\n\nI've still not audited the full source and quite frankly I'd like somebody\nelse to do that since it's not only boring, but it's all my code, so I'm\nblind to any bugs anyway.\n\nBut I _have_ straced a full sequence of the daemon side of a \"git pull\"  \nand grepped every \"open()\", and they were all O_RDONLY, and every read()\nfrom the incoming file descriptor was using the \"packet-line\" interface\nwhich is designed to be safe too (ie there are no possibilities of\noverflows there that I can see). \n\n\t\t\tLinus\n"}]}