git 2.2.x: Unexpected, overstrict file permissions after "git update-server-info"

Hello,

We recently upgraded to git 2.2.1 from 2.1.x and faced issue with accessing repositories over dump HTTP protocol. In our setting, repositories are managed by Gerrit, so owned by Gerrit daemon user, but we also offer anon access via smart and dumb HTTP protocols. For the latter, we of course rely on "git update-server-info" being run.

So, after the upgrade, users started to report that accessing info/refs file of a repo, as required for HTTP dump protocol, leads to 403 Forbidden HTTP error. We traced that to 0600 filesystem permissions for such files (for objects/info/packs too) (owner is gerrit user, to remind). After resetting permissions to 0644, they get back to 0600 after some time (we have a cronjob in addition to a hook to run "git update-server-info"). umask is permissive when running cronjob (0002).

I traced the issue to: https://github.com/git/git/commit/d38379ece9216735ecc0ffd76c4c4e3da217daec

It says: "Let's instead switch to using a unique tempfile via mkstemp." Reading man mkstemp: "The file is created with permissions 0600". So, that's it. The patch above contains call to adjust_shared_perm(), but apparently it doesn't promote restrictive msktemp permissions to something more accessible.

Hope this issue can be addressed.

Thanks, Paul

Linaro.org | Open source software for ARM SoCs Follow Linaro: http://www.facebook.com/pages/Linaro http://twitter.com/#!/linaroorg - http://www.linaro.org/linaro-blog