Re: How to prevent changes to repository by root

From: Pete Harlan <pgit@pcharlan.com>
Date: Jun 18, 2010, 20:45 UTC
Message-ID: <4C1BDAED.3030809@pcharlan.com>
In-Reply-To: <AANLkTimjIraq-qDaifACixJ4cCOYuvkf1v-hVpeaVt3u@mail.gmail.com>

On 06/16/2010 07:28 PM, Nazri Ramliy wrote:

Show 11 quoted lines

> On Thu, Jun 17, 2010 at 12:09 AM, Aneurin Price <aneurin.price@gmail.com> wrote:
>> How are they becoming root? If they are using sudo you could forbid
>> running git as root. If they are using su or logging in directly maybe
>> you can get away with some trivial thing like putting 'alias
>> git=/bin/false' in /root/.bashrc - or some wrapper which does
>> something helpful rather than silently fail :-).
> 
> Thanks for dropping the hint on wrapper.
> 
> I've implemented one that give the user a friendly reminder
> that they are running git as root and ask whether to continue.

When I needed this I wrote a hook that refused a commit by root unless the commit message said something to the effect of:

Root commit performed by <person or script name>.

It's not that I minded so much that root was doing commits, it's the anonymity that was the problem.  So automated scripts that ran as root could perform commits too, they just had to include this note in the commit message so we knew which script was doing it.  It was all the honor-system, but it did what we wanted and prevented committing as root by accident.

--Pete