{"thread":{"id":"22180","subject":"[RFH] Git and filesystem ACLs: problem with 'git gc'","startedAt":"2010-01-12T13:57:10Z","lastAt":"2010-01-13T14:56:58Z","messageCount":2,"participants":["Matthieu Moy"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"131371","messageId":"vpqy6k38lzd.fsf@bauges.imag.fr","threadId":"22180","inReplyTo":null,"subject":"[RFH] Git and filesystem ACLs: problem with 'git gc'","fromName":"Matthieu Moy","fromEmail":"matthieu.moy@grenoble-inp.fr","sentAt":"2010-01-12T13:57:10Z","receivedAt":"2010-01-12T13:57:10Z","isPatch":false,"sender":{"key":"matthieu.moy@grenoble-inp.fr","avatar":"https://gravatar.com/avatar/72c8a2705971a25dfaff23cece15130d405685845d911aedd5667ace277f3fc5?d=mp&s=160"},"body":"Hi,\n\nI tried setting up a Git repository restricting the access using the\nfilesystem's ACL. In short: It almost works, but pack creation break\nit. I'm looking for help to fix it.\n\nThe setup is: my user is \"moy\", my $HOME is rwx------ and my umask is\n077 (i.e. by default, I don't share anything). I want to authorize a\nuser \"foo\" to access my repository:\n\ncd ~/test/\ngit init testacl\nsetfacl -Rm u:foo:rwx '/home/moy/test/testacl'\nsetfacl -Rm d:u:foo:rwx '/home/moy/test/testacl'\nsetfacl -Rm d:u:moy:rwx '/home/moy/test/testacl'\nsetfacl -m u:foo:x '/home/moy/test'\nsetfacl -m u:foo:x '/home/moy'\n\nWith this setup, I can create new files, and the user foo can do the\nsame, the ACLs give permission to each other. Object creation (git\nadd, git commit) work:\n\n$ getfacl .git/objects/3c/7a37f109f8e7f7b9f8b64833ea331fa9b047f5 \n# file: .git/objects/3c/7a37f109f8e7f7b9f8b64833ea331fa9b047f5\n# owner: moy\n# group: perms\nuser::r--\nuser:moy:rwx\nuser:foo:rwx\ngroup::---\nmask::rwx\nother::r--\n\nbut when pack files are created by a user, the file is not readable by\nthe other:\n\n$ getfacl .git/objects/pack/pack-cf224e8b0da92fd72fbea8f101912db4835445d1.pack \n# file: .git/objects/pack/pack-cf224e8b0da92fd72fbea8f101912db4835445d1.pack\n# owner: moy\n# group: perms\nuser::r--\nuser:moy:rwx\t\t\t#effective:---\nuser:len:rwx\t\t\t#effective:---\ngroup::---\nmask::---\nother::---\n\n$ ls -l .git/objects/pack/pack-cf224e8b0da92fd72fbea8f101912db4835445d1.pack \n-r--------+ 1 moy perms 468 Jan 12 13:18 .git/objects/pack/pack-cf224e8b0da92fd72fbea8f101912db4835445d1.pack\n\nMy interpretation of the problem is that Git tried to remove the\npermission for group (~ chmod g-rwx) on the pack file, and as an\nundesirable side effect, setting the group permissions also sets the\nACL mask, and prevents other users from accessing it, even though they\nhave a user-ACL.\n\nA workaround for this is to set core.sharedrepository to 'group', but\nsince object creation just works, I guess the pack creation should\njust work too, with or without core.sharedrepository ...\n\nI investigated a bit, and the problem seems to come from mkstemp,\nwhich is used by write_pack_file to create the temporary file: files\ncreated by mkstemp get an ACL umask of ---.\n\nIs it really a good idea to use mkstemp? We're inside\n.git/object/pack, for which the user is supposed to have already set\ncorrect permissions, so shouldn't we just create a random file name\nand then use a plain open(...) to create the file, leaving the umask\ndo its job to control the permissions?\n\nThanks,\n\n--\nMatthieu Moy\nhttp://www-verimag.imag.fr/~moy/\n"},{"id":"131479","messageId":"vpqeiludpdx.fsf@bauges.imag.fr","threadId":"22180","inReplyTo":"vpqy6k38lzd.fsf@bauges.imag.fr","subject":"Re: [RFH] Git and filesystem ACLs: problem with 'git gc'","fromName":"Matthieu Moy","fromEmail":"matthieu.moy@grenoble-inp.fr","sentAt":"2010-01-13T14:56:58Z","receivedAt":"2010-01-13T14:56:58Z","isPatch":false,"sender":{"key":"matthieu.moy@grenoble-inp.fr","avatar":"https://gravatar.com/avatar/72c8a2705971a25dfaff23cece15130d405685845d911aedd5667ace277f3fc5?d=mp&s=160"},"body":"Matthieu Moy <Matthieu.Moy@grenoble-inp.fr> writes:\n\n> I investigated a bit, and the problem seems to come from mkstemp,\n> which is used by write_pack_file to create the temporary file: files\n> created by mkstemp get an ACL umask of ---.\n>\n> Is it really a good idea to use mkstemp? We're inside\n> .git/object/pack, for which the user is supposed to have already set\n> correct permissions, so shouldn't we just create a random file name\n> and then use a plain open(...) to create the file, leaving the umask\n> do its job to control the permissions?\n\nDigging a bit further, I noticed that _object_ creation was doing a\n\n  set_shared_perm(filename, (S_IFREG|0444))\n\nthus ignoring the umask, and setting r--r--r-- for all objects, while\n_pack_ creation does roughly (in write_pack_file()) :\n\n  mode_t mode = umask(0);\n  mode = 0444 & ~mode;\n  adjust_perm(pack_tmp_name, mode)\n\nThus setting the permissions to r--X--X-- where X is defined by the\numask. Is there any reason for this difference? I'd say we can rely on\nthe containing directory's permissions, and do for pack what Git\nalready does for objects.\n\n[ On a side note, I don't understand what the S_IFREG is doing in the\ncall to set_shared_perm. It's passed to chmod, while S_IFREG is only\ndocumented in the manpage for stat() ... ]\n\nThanks,\n\n-- \nMatthieu Moy\nhttp://www-verimag.imag.fr/~moy/\n"}]}