git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: what are the chances of a 'pre-upload' hook?

From
Jeff King <peff@peff.net>
Date
Nov 28, 2011, 08:27 UTC
Message-ID
<20111128082758.GD16901@sigill.intra.peff.net>
In-Reply-To
<CAMK1S_hX3fEf1nL28yxASLw_cveJbC5aQRdixgBF6zaPyAEsdA@mail.gmail.com>
On Mon, Nov 28, 2011 at 01:47:44PM +0530, Sitaram Chamarty wrote:
Show 9 quoted lines
> > Jeff may be right that any approach based on hooks cannot be made totally
> > safe. But the discussion can lead to a workable alternative. The "enable
> > the hook only on git:// and http:// and no other" approach might or might
> > not be such a workable alternative. The "try talking to a service process
> > via named pipe, instead of spawning a hook" might or might not be such a
> > workable alternative. Other possibilities may be there to be explored.
> 
> There are only 2 cases: git-upload-pack runs as invoking user, or it
> runs as some common user/repo owner.

I think it is slightly more complicated. You may have a common user, but that user may or may not trust the contents of the repo on disk (e.g., a system daemon serving repos for arbitrary users).

> I see pre-upload hooks for case 1 as being hard/impossible to do,
> while case 2 is trivial (just check if the hook file owner == UID of
> the git-upload-pack process).

The UID check doesn't quite tell you what you want. If I am in a shared repo situation with a liberal umask and I write a hook, it will have my UID. But it may have group-write permissions. Other people in my group can write arbitrary contents to the file, but it will retain my UID, and git's check will think the code is OK to run.

> Yes, this means pre-upload won't work identically in *all* setups.
> But as you said somewhere: perfect is the enemy of good.

Yes, I think we have to accept inconsistency if we have them at all. Because such hooks are dangerous in some setups, and OK in others. So no matter what the rule for determining danger, they will sometimes run and sometimes not.

-Peff
Previous: Sitaram ChamartyNext: Jeff King
Message 21 of 23 in “what are the chances of a 'pre-upload' hook?”
  1. Sitaram ChamartyNov 25, 2011
  2. Martin FickNov 25, 2011
  3. Martin FickNov 25, 2011
  4. Sitaram ChamartyNov 25, 2011
  5. Andreas EricssonNov 25, 2011
  6. Sitaram ChamartyNov 25, 2011
  7. Jeff KingNov 25, 2011
  8. Junio C HamanoNov 26, 2011
  9. Jeff KingNov 26, 2011
  10. Junio C HamanoNov 26, 2011
  11. Jeff KingNov 26, 2011
  12. Junio C HamanoNov 27, 2011
  13. Jeff KingNov 26, 2011
  14. Jeff KingNov 27, 2011
  15. Junio C HamanoNov 27, 2011
  16. Sitaram ChamartyNov 27, 2011
  17. Junio C HamanoNov 28, 2011
  18. Jeff KingNov 28, 2011
  19. Sitaram ChamartyNov 28, 2011
  20. Sitaram ChamartyNov 28, 2011
  21. Jeff KingNov 28, 2011
  22. Jeff KingNov 28, 2011
  23. Jeff KingNov 28, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.