{"thread":{"id":"43914","subject":"Smart HTTP push permissions failure","startedAt":"2016-08-23T16:40:08Z","lastAt":"2016-08-25T18:33:53Z","messageCount":3,"participants":["David McGough","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"299960","messageId":"89CBBBEBEE33F5469A9FA456B5F70625CCDB9BEB@otwlxg20.opentext.net","threadId":"43914","inReplyTo":null,"subject":"Smart HTTP push permissions failure","fromName":"David McGough","fromEmail":"dmcgough@opentext.com","sentAt":"2016-08-23T15:45:33Z","receivedAt":"2016-08-23T16:40:08Z","isPatch":false,"sender":{"key":"dmcgough@opentext.com","avatar":null},"body":"Hi Git Community!\n\nI'm trying to get Git on the server.  I installed Git and httpd on Centos 7 and configred for smart http.  I created a project on my local git and I cloned it to a base repository:\ngit clone --bare DataConversion DataConversion.git then I scp it to the server: scp -r DataConversion git@xx.xx.xx.xx:/opt/git/repository/product/tools.  Then on the server for the project I ran git config core.sharedRepository group  \n\nI added a remote server to my local project: git remote add origin http://xx.xx.xx.xx/git/product/tools/DataConversion.git\n\ngit remote -v shows:\norigin  http://xx.xx.xx.xx/git/product/tools/DataConversion.git (fetch)\norigin  http://xx.xx.xx.xx/git/product/tools/DataConversion.git (push)\n\nWhen I try to push to the server I get this message:\nremote: error: insufficient permission for adding an object to repository database ./objects\nremote: fatal: failed to write object\n\nFwiw I can clone the project from the server to my local.\n\nHere are the permssions on the project and the objects folder.\n\n[git@services-git DataConversion.git]$ pwd\n/opt/git/repos/product/tools/DataConversion.git\n[git@services-git DataConversion.git]$ ll\ntotal 24\n-rwxrwxr-x.  1 git staff  196 Aug 23 11:24 config\n-rwxrwxr-x.  1 git staff   73 Aug 22 15:28 description\n-rwxrwxr-x.  1 git staff   23 Aug 22 15:28 HEAD\ndrwxrwxr-x.  2 git staff 4096 Aug 22 15:28 hooks\ndrwxrwxr-x.  2 git staff   20 Aug 22 15:28 info\ndrwxrwxr-x. 65 git staff 4096 Aug 22 16:50 objects\n-rwxrwxr-x.  1 git staff   98 Aug 22 15:29 packed-refs\ndrwxrwxr-x.  4 git staff   29 Aug 22 15:29 refs\n[git@services-git DataConversion.git]$\n[git@services-git DataConversion.git]$ cd objects\n[git@services-git objects]$ ll\ntotal 12\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 06\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 08\ndrwxrwxr-x. 2 git staff   96 Aug 22 15:28 0a\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 17\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 19\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 1c\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 24\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 29\ndrwxrwxr-x. 2 git staff 4096 Aug 22 15:28 30\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 32\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 33\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 3d\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 3f\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 41\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 4b\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 57\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 5a\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 5d\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 5f\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 64\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 65\ndrwxrwxr-x. 2 git staff 4096 Aug 22 15:28 69\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 6d\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 70\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 74\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 7a\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 7b\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 7c\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 84\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 89\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 8a\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 8c\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 93\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 9d\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 a0\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 a2\ndrwxrwxr-x. 2 git staff 4096 Aug 22 15:28 a3\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 a6\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 ab\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 af\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 b1\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 b7\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 b8\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 c3\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 c8\ndrwxrwxr-x. 2 git staff   96 Aug 22 15:28 c9\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 cb\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:28 cf\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 d1\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 d8\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 d9\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 db\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 dc\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 e1\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 e7\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 e9\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 ea\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 ed\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 f0\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 f3\ndrwxrwxr-x. 2 git staff   51 Aug 22 15:29 f5\ndrwxrwxr-x. 2 git staff    6 Aug 22 15:29 info\ndrwxrwxr-x. 2 git staff    6 Aug 22 15:29 pack\n\napache and git users are both in the staff group, and staff group is their default group.  I have also tried to use the set group id bit but to no avail. http://www.gnu.org/software/coreutils/manual/html_node/Directory-Setuid-and-Setgid.html\n\n[root@services-git DataConversion.git]# groups apache\napache : staff git\n[root@services-git DataConversion.git]# groups git\ngit : staff apache\n\nSo I am pretty confused about what the issue.  Which OS user is git using to write the files?  I hope somebody can help me understand why the project cannot be pushed to the git server.  \n\nThanks,\nDave\n\n  \n\n\n\n\n\n\n"},{"id":"300081","messageId":"20160824170028.y4kr5jchsnb5xdge@sigill.intra.peff.net","threadId":"43914","inReplyTo":"89CBBBEBEE33F5469A9FA456B5F70625CCDB9BEB@otwlxg20.opentext.net","subject":"Re: Smart HTTP push permissions failure","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2016-08-24T17:00:28Z","receivedAt":"2016-08-24T17:01:15Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, Aug 23, 2016 at 03:45:33PM +0000, David McGough wrote:\n\n> When I try to push to the server I get this message:\n> remote: error: insufficient permission for adding an object to repository database ./objects\n> remote: fatal: failed to write object\n> [...]\n> So I am pretty confused about what the issue.  Which OS user is git\n> using to write the files?  I hope somebody can help me understand why\n> the project cannot be pushed to the git server.\n\nFor a smart-http push, it will be whatever user the web server execs the\nCGI as. So I'd think \"apache\" would be the default, but it's possible\nthat it runs CGIs as a different user, depending on your config.\n\nOne possibility may be to add a simple shell script CGI that does\nsomething like:\n\n  #!/bin/sh\n  echo \"Content-type: text/plain\"\n  echo\n  id\n\njust to see what's happening.\n\nBased on the data you showed, here are some wild possibilities I can\nthink of:\n\n  - the CGI runs as \"apache\", but your files are owned by \"git\".\n    \"apache\" is in the \"staff\" group, and the directories all have write\n    permission for that group. But are we sure that apache does not shed\n    any group permissions when running a CGI? The \"id\" script above\n    should hopefully show that.\n\n  - You mentioned CentOS. It has been a while since I dealt with RHEL\n    and its derivatives, but I think selinux is turned on by default\n    there. Is it possible that the webserver runs in an selinux profile\n    that does not allow writing to the repository directory?\n\n    I don't recall the specifics of debugging selinux problems, but\n    there may be logs there.\n\nSorry those are just stabs in the dark, but I don't see anything else\nobviously wrong with what you've posted.\n\n-Peff\n"},{"id":"300181","messageId":"89CBBBEBEE33F5469A9FA456B5F70625CCDC7A1B@otwlxg21.opentext.net","threadId":"43914","inReplyTo":"20160824170028.y4kr5jchsnb5xdge@sigill.intra.peff.net","subject":"RE: Smart HTTP push permissions failure","fromName":"David McGough","fromEmail":"dmcgough@opentext.com","sentAt":"2016-08-25T18:33:06Z","receivedAt":"2016-08-25T18:33:53Z","isPatch":false,"sender":{"key":"dmcgough@opentext.com","avatar":null},"body":"Thank you for your reply Jeff.  I have moved on to installing GitLab.  It has been a success so far.\n\nThanks,\nDave\n\n-----Original Message-----\nFrom: Jeff King [mailto:peff@peff.net] \nSent: Wednesday, August 24, 2016 1:00 PM\nTo: David McGough <dmcgough@opentext.com>\nCc: git@vger.kernel.org\nSubject: Re: Smart HTTP push permissions failure\n\nOn Tue, Aug 23, 2016 at 03:45:33PM +0000, David McGough wrote:\n\n> When I try to push to the server I get this message:\n> remote: error: insufficient permission for adding an object to \n> repository database ./objects\n> remote: fatal: failed to write object\n> [...]\n> So I am pretty confused about what the issue.  Which OS user is git \n> using to write the files?  I hope somebody can help me understand why \n> the project cannot be pushed to the git server.\n\nFor a smart-http push, it will be whatever user the web server execs the CGI as. So I'd think \"apache\" would be the default, but it's possible that it runs CGIs as a different user, depending on your config.\n\nOne possibility may be to add a simple shell script CGI that does something like:\n\n  #!/bin/sh\n  echo \"Content-type: text/plain\"\n  echo\n  id\n\njust to see what's happening.\n\nBased on the data you showed, here are some wild possibilities I can think of:\n\n  - the CGI runs as \"apache\", but your files are owned by \"git\".\n    \"apache\" is in the \"staff\" group, and the directories all have write\n    permission for that group. But are we sure that apache does not shed\n    any group permissions when running a CGI? The \"id\" script above\n    should hopefully show that.\n\n  - You mentioned CentOS. It has been a while since I dealt with RHEL\n    and its derivatives, but I think selinux is turned on by default\n    there. Is it possible that the webserver runs in an selinux profile\n    that does not allow writing to the repository directory?\n\n    I don't recall the specifics of debugging selinux problems, but\n    there may be logs there.\n\nSorry those are just stabs in the dark, but I don't see anything else obviously wrong with what you've posted.\n\n-Peff\n"}]}