git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Repository Security

From
AMAndre Masella <andre@masella.no-ip.org>
Date
Jan 23, 2007, 13:23 UTC
Message-ID
<200701230823.20061.andre@masella.no-ip.org>
In-Reply-To
<ep4q5e$ioc$1@sea.gmane.org>
Show 7 quoted lines
> > As I understand it, none of the repository backends allow any per-user
> > per-branch access control. SSH and HTTP come the closest with the right
> > hooks, but since the repository is writeable by those users, there is
> > little to stop them from changing the repository directly.
> I wonder if it would be enought for SSH (and perhaps HTTP/WebDAV access)
> just to rely on filesystem write access to refs/heads files (different
> files having different access rights), and filesystem ACLs.

It could probably be done, but it would be very complicated. For instance, if a user is allowed to run prune, then they must have permissions to delete files which would include any of the objects.

For DAV, this breaks down completely because all access to the repository will happen as the Apache user.

-- 
--Andre Masella (andre at masella.no-ip.org)
Previous: Jakub NarebskiNext: Johannes Schindelin
Message 10 of 13 in “Repository Security”
  1. Andre MasellaJan 22, 2007
  2. Shawn O. PearceJan 22, 2007
  3. Andre MasellaJan 23, 2007
  4. Martin LanghoffJan 22, 2007
  5. Johannes SchindelinJan 23, 2007
  6. Andre MasellaJan 23, 2007
  7. Johannes SchindelinJan 23, 2007
  8. Andy ParkinsJan 23, 2007
  9. Jakub NarebskiJan 23, 2007
  10. Andre MasellaJan 23, 2007
  11. Johannes SchindelinJan 23, 2007
  12. Andreas EricssonJan 24, 2007
  13. Linus TorvaldsJan 23, 2007

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.