Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1

From: Jamie Landeg-Jones <jamie@catflap.org>
Date: Jul 28, 2024, 03:46 UTC
Message-ID: <202407280346.46S3khd9005129@donotpassgo.dyslexicfish.net>
In-Reply-To: <5747ba0d-7268-4538-9705-11650a7d6e35@gmail.com>

"David C. Rankin" <drankinatty@gmail.com> wrote:

> I too am stuck. It's a damned if you do, damned if you don't Hobson's choice 
> of git repo ownership on the server. All worked fine serving both https and 
> ssh prior to the change, now it is either one or the other but not both. So 
> either your read-only pulls and clones are hosed, or your read/write are.

Thanks for the reply. I guess I'm potentially not as stuck as you, because I don't require ssh access to the repos - they are just mirrors. I have one unix user that updates the repository, and the cgit and git https backends run as another suexec user exclusively for that task. However, I'm not going to compromise security by giving the web user effective write-access to the files it only needs read access to.

> If more info is needed, let me know and I'm happy to privide it.

If you have any solution, I'd be grateful to hear. I'm a bit puzzled to what's going on though.

From what I gather, the idea was to stop a client user from unintentionally running potential hook scripts that could be evil. A similar protection was already present, I note, for other methods (I couldn't run git log and other commands directly on a repo i had unix-level read access to, but were owned by another user until I added the safe directory thing in .gitconfig)

Closing this hole to make security more consistent is fair enough... however, in the case of git-http-backend the "safe directory" method doesn't work at all!

Is this an accurate summary of the situation?

As an aside, do you know why this security mechanism blocks ALL access, and not just the execution of hooks? - my mirrors don't have any hook-scripts, and as long as I give them read access at the unix level, why are they still blocked from doing things like "git log" on a repo without having to first mark it as safe?

Cheers, Jamie