Re: Removal of post-upload-hook

From: Robin H. Johnson <robbat2@gentoo.org>
Date: Jan 14, 2010, 21:06 UTC
Message-ID: <20100114210645.GE16921@orbis-terrarum.net>
In-Reply-To: <20100114204305.GC26883@coredump.intra.peff.net>

On Thu, Jan 14, 2010 at 03:43:05PM -0500, Jeff King wrote:

Show 14 quoted lines

> On Thu, Jan 14, 2010 at 11:41:07AM -0800, Shawn O. Pearce wrote:
> 
> > > Because receive-pack runs as the user who is pushing, not as the
> > > repository owner. So by convincing you to push to my repository in a
> > > multi-user environment, I convince you to run some arbitrary code of
> > > mine.
> > 
> > Uhhh, this was in fetch/upload-pack Peff, not push/receive-pack.
> > 
> > Same issue though.
> Errr...yeah. Sorry for the confusion. But yes, it's the same mechanism,
> except that it is even easier to get people to pull from you (to get
> them to push, you first have to get them to write a worthwhile code
> contribution. ;) ).

post-update, post-receive, update, pre-receive would all be subject to
this problem as well if:
- the repo was group/world-writable
- the hook is untrusted

post-upload-pack just required group/world-readable and untrusted hook code.

I'd like to lodge a complaint about the removal of the functionality. I would have commented on the patch prior to this, but even searching I didn't see it cross the list.

As a reasonable middle ground between the functionality and complete removal, can we find a way just to only execute the potentially dangerous hooks under known safe conditions or when explicitly requested by the user.

Places where the hooks are safe:
- the hooks are known trusted AND not writable by the user/group.
  (e.g. "chown -R root:root hooks/").
- Systems where the users/groups do not have full shell access, just
  access to run Git itself. Eg gitosis, regular git+ssh:// w/ a
  restricted shell.

Upcoming use case: For Gentoo's work on migrating to Git, we've been working on a pre-upload-pack hook and script that can explicitly block the generation of some packs. Basically, unless you send a sufficiently recent 'have' line, you are told to fetch a bundle via HTTP or rsync instead.

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Trustee & Infrastructure Lead
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85