[RFC/PATCH] shell: allow 'help' command to disable interactive shell
- From
Jonathan Nieder <jrnieder@gmail.com>
- Date
- Feb 11, 2013, 01:20 UTC
- Message-ID
- <20130211012016.GA13243@elie.Belkin>
- In-Reply-To
- <CAMK1S_jFUXiHM6teVwoxO9gv77B1KBQoSi-B32dwVKemXnDx9w@mail.gmail.com>
If I disable git-shell's interactive mode by removing the ~/git-shell-commands directory, then attempts to use 'ssh' with the git account interactively produce an error message intended for the administrator:
$ ssh git@myserver fatal: Interactive git shell is not enabled. hint: ~/git-shell-commands should exist and have read and execute access. $
It is better to give the user a friendly hint that she is on the right track, like GitHub does:
Hi <username>! You've successfully authenticated, but GitHub does not provide shell access.
An appropriate greeting might even include more complex information, like a list of repositories the user has access to. A git-shell-commands directory with only a "help" script can get us most of the way there, but it unfortunately it produces a "git>" prompt where the user can do nothing but ask for more help or exit. So allow the "help" script to abort the shell by exiting with nonzero status.
Downside: this will prevent interactive git-shell logins in existing setups where the "help" script exits with nonzero status by mistake. Hopefully those are rare enough to not cause much trouble in practice.
Reported-by: Ethan Reesor <firelizzard@gmail.com> Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> --- Sitaram Chamarty wrote:
Show 6 quoted lines
> Indeed! In gitolite, I borrowed that idea added to it by making it > print a list of repos you have access to, along with what permissions > (R or RW) you have :-) > > I'm not suggesting git should do that, but instead of a fixed string, > a default command to be executed would be better.
Good call.
[...]
> This of course now means that the ~/git-shell-commands should not be > empty, since that is where this default command also will be present.
How about this?
A patch on top could change the default "git-shell-commands is not present" message if that seems worthwhile.
Documentation/git-shell.txt | 26 ++++++++++++++++++++++++++ shell.c | 10 ++++++++-- 2 files changed, 34 insertions(+), 2 deletions(-)
diff --git a/Documentation/git-shell.txt b/Documentation/git-shell.txt index 9b925060..758083ff 100644 --- a/Documentation/git-shell.txt +++ b/Documentation/git-shell.txt @@ -29,6 +29,32 @@ read and execute permissions to the directory in order to execute the programs in it. The programs are executed with a cwd of $HOME, and <argument> is parsed as a command-line string. +When run interactively (with no arguments), 'git-shell' will +automatically run `~/git-shell-commands/help` on startup, provided it +exists. If the 'help' command fails then the interactive shell is +aborted. + +EXAMPLE +------- + +To disable interactive logins, displaying a greeting instead: ++ +---------------- +$ chsh -s /usr/bin/git-shell +$ mkdir $HOME/git-shell-commands +$ cat >$HOME/git-shell-commands/help <<\EOF +#!/bin/sh +printf '%s\n' "Hi $USER! You've successfully authenticated, but I do not" +printf '%s\n' "provide interactive shell access." +exit 128 +EOF +$ chmod +x $HOME/git-shell-commands/help +---------------- + +SEE ALSO +-------- +contrib/git-shell-commands/README + GIT --- Part of the linkgit:git[1] suite diff --git a/shell.c b/shell.c index 84b237fe..3abc2b84 100644 --- a/shell.c +++ b/shell.c @@ -63,10 +63,16 @@ static void cd_to_homedir(void) static void run_shell(void) { - int done = 0; + int done = 0, status; static const char *help_argv[] = { HELP_COMMAND, NULL }; /* Print help if enabled */ - run_command_v_opt(help_argv, RUN_SILENT_EXEC_FAILURE); + status = run_command_v_opt(help_argv, RUN_SILENT_EXEC_FAILURE); + if (!status) + ; /* success */ + else if (status == -1 && errno == ENOENT) + ; /* help disabled */ + else + exit(status); do { struct strbuf line = STRBUF_INIT;
-- 1.8.1.3