Re: [RFC/PATCH] shell: allow 'help' command to disable interactive shell

From: Jeff King <peff@peff.net>
Date: Feb 11, 2013, 16:00 UTC
Message-ID: <20130211160057.GA16402@sigill.intra.peff.net>
In-Reply-To: <7v8v6vpbej.fsf@alter.siamese.dyndns.org>

On Sun, Feb 10, 2013 at 11:17:24PM -0800, Junio C Hamano wrote:

Show 10 quoted lines

> Jonathan Nieder <jrnieder@gmail.com> writes:
> 
> > Isn't that a criticism of the git-shell-commands facility in general?
> > If it is common to have a lot of users with distinct home directories
> > but all with git-shell as their login shell, then the
> > git-shell-commands should not go in their home directory to begin
> > with, no?
> 
> You can give one set of commands to some users while restricting
> others, no?

But that seems to me to argue against /etc/git/shell-disabled or similar, which would apply to every user. Or are you proposing that the check be:

  if -d ~/git-shell-commands; then
          : ok, interactive
  elif -x /etc/git/shell-disabled; then
          exec /etc/git/shell-disabled
  else
          echo >&2 'go away'
          exit 1
  fi

That at least means you can apply _whether_ to disable the shell selectively for each user (by providing or not a git-shell-commands directory), but you cannot individually select the script that runs for that user. But it's probably still flexible enough; you can, after all, run arbitrary code in the shell-disabled script, so it can select which class of user it was called on and dispatch to a sub-script.

-Peff