Re: git-daemon is insecure?

"Shawn O. Pearce" <spearce@spearce.org> writes:

That was not what I meant. git-daemon running as nobody.project will allow read access to project group's files, and the whitelisting and --base-path are ways to limit it to files that are in the repository. But the process still has the power to read files outside that can be read nobody user or project group, the only thing needed is for git-daemon and whatever it spawn to have bugs.

But the point is that "power to read files outside" is still limited to nobody.project, even if there are such bugs to allow it escape the whitelist/base-path jail. It won't extend to anybody's $HOME.

If you run git-daemon as spearce.spearce, you cannot rely on that built-in limitation.