Re: shared GIT repos

From: Linus Torvalds <torvalds@osdl.org>
Date: Sep 27, 2005, 15:21 UTC
Message-ID: <Pine.LNX.4.58.0509270807580.3308@g5.osdl.org>
In-Reply-To: <20050927084513.GU31276@kiste.smurf.noris.de>

On Tue, 27 Sep 2005, Matthias Urlichs wrote:

Show 7 quoted lines

> 
> Junio C Hamano:
> > Do you want to guard the repository from malicious users?  Or is
> > it enough to guard a casual/careless user from making mistakes?
> > 
> Well, s/malicious users/somebody who wants to cover up an ugly mistake/
> would be more accurate.

Hmm.

What you _can_ do is to make your object and refs directories sticky.

That automatically means that only the owner of a file can remove it.

Now, people can still cover up their _own_ mistakes in that case, but they can't change other peoples branches (since that involves overwriting somebody elses ref), and they can't remove objects that somebody else has written.

But they can, for example, change their _own_ branch to not have a ref to that object, of course.

A more draconian option is to make the git programs setgid to a "git" group, and making the object and ref directories only writable by the git group. And then you change all the git programs to verify whatever rules you have. That requires pretty big changes, though.

For example, you'd have to make all the scripts use the new git-update-ref thing, and if you want to enforce that any new ref is a proper child of the old ref, then you'd have to make git-update-ref test that one explicitly (instead of leaving it to the scripts).

Quite frankly, I'd rather avoid that.

Oh. One thing you can do: don't allow direct filesystem access at _all_. Use ssh to log in (even if it's on the same machine) as a special user which is the only one that is allowed to touch the repo, and make that special users login shell only accept git-receive-pack.

I wrote and posted an untested "git-sh" that did that some time ago, holler if you want it again.

Add logging, and testing, and it should give you a safe write-only alternative to "git-daemon" that only allows people to append to the git history (oh, you'd still have to add some _small_ code to git-receive-pack to not allow the "ignore old ref contents" case, but that's like two lines of code).

			Linus