Re: [RFC] daemon whitelist handling (Re: git pull aborts in 50% of cases)

From: H. Peter Anvin <hpa@zytor.com>
Date: Dec 3, 2005, 20:45 UTC
Message-ID: <439203F6.1040505@zytor.com>
In-Reply-To: <7vvey6vsop.fsf@assigned-by-dhcp.cox.net>

Junio C Hamano wrote:

Show 13 quoted lines

> "H. Peter Anvin" <hpa@zytor.com> writes:
> 
>>At the very least, if you insist on using getcwd() names, you should 
>>pre-canonicalize the whitelist, too.
> 
> With the current "prefix" rule (and not allowing /ho to match
> /home) that sounds possible and sensivle, but that is not nice
> in the long run.  We may later want to say "/pub/git/**/*.git"
> for example to mean "any subdirectory under /pub/git but the
> base directory name must be something ending with '.git'".
> 
> Hmm...
>

Yep, this stuff is hard. For example, on kernel.org I'm not concerned about symbolic links; the likelihood of an accidental symbolic link that would violate security is very small. Other applications might be different.

Arguably, the correct interface is to modularize it, and have both the user request, the post-DWIM output, and the

	-hpa