[RFH] Git and filesystem ACLs: problem with 'git gc'

Hi,

I tried setting up a Git repository restricting the access using the filesystem's ACL. In short: It almost works, but pack creation break it. I'm looking for help to fix it.

The setup is: my user is "moy", my $HOME is rwx------ and my umask is 077 (i.e. by default, I don't share anything). I want to authorize a user "foo" to access my repository:

cd ~/test/ git init testacl setfacl -Rm u:foo:rwx '/home/moy/test/testacl' setfacl -Rm d:u:foo:rwx '/home/moy/test/testacl' setfacl -Rm d:u:moy:rwx '/home/moy/test/testacl' setfacl -m u:foo:x '/home/moy/test' setfacl -m u:foo:x '/home/moy'

With this setup, I can create new files, and the user foo can do the same, the ACLs give permission to each other. Object creation (git add, git commit) work:

$ getfacl .git/objects/3c/7a37f109f8e7f7b9f8b64833ea331fa9b047f5 # file: .git/objects/3c/7a37f109f8e7f7b9f8b64833ea331fa9b047f5 # owner: moy # group: perms user::r-- user:moy:rwx user:foo:rwx group::--- mask::rwx other::r--

but when pack files are created by a user, the file is not readable by the other:

$ getfacl .git/objects/pack/pack-cf224e8b0da92fd72fbea8f101912db4835445d1.pack # file: .git/objects/pack/pack-cf224e8b0da92fd72fbea8f101912db4835445d1.pack # owner: moy # group: perms user::r-- user:moy:rwx #effective:--- user:len:rwx #effective:--- group::--- mask::--- other::---

$ ls -l .git/objects/pack/pack-cf224e8b0da92fd72fbea8f101912db4835445d1.pack -r--------+ 1 moy perms 468 Jan 12 13:18 .git/objects/pack/pack-cf224e8b0da92fd72fbea8f101912db4835445d1.pack

My interpretation of the problem is that Git tried to remove the permission for group (~ chmod g-rwx) on the pack file, and as an undesirable side effect, setting the group permissions also sets the ACL mask, and prevents other users from accessing it, even though they have a user-ACL.

A workaround for this is to set core.sharedrepository to 'group', but since object creation just works, I guess the pack creation should just work too, with or without core.sharedrepository ...

I investigated a bit, and the problem seems to come from mkstemp, which is used by write_pack_file to create the temporary file: files created by mkstemp get an ACL umask of ---.

Is it really a good idea to use mkstemp? We're inside .git/object/pack, for which the user is supposed to have already set correct permissions, so shouldn't we just create a random file name and then use a plain open(...) to create the file, leaving the umask do its job to control the permissions?

Thanks,

-- Matthieu Moy http://www-verimag.imag.fr/~moy/