Re: [PATCH 2/2] git wrapper: execute git-shell when argv[1] is '-c'

From: Matthieu Moy <matthieu.moy@imag.fr>
Date: Aug 26, 2008, 06:53 UTC
Message-ID: <vpqy72ktgg7.fsf@bauges.imag.fr>
In-Reply-To: <alpine.DEB.1.00.0808260249090.24820@pacific.mpi-cbg.de.mpi-cbg.de>

Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:

Show 7 quoted lines

> On Tue, 26 Aug 2008, Tommi Virtanen wrote:
>
>> All I'm going to say is that that's not the way you build trustable 
>> software. You take a minimal interface and restrict untrusted users to 
>> that, you don't add a feature to the widest possible interface..
>
> I do not get your point.

With your patch, AAUI, one would put /usr/bin/git as a shell in passwd. It's pretty clear that someone calling the shell with -c will get the restriction of git-shell, but I'd hardly guarantee that the shell in /etc/passwd will never be called without -c. At least, if the user tries to login, he will execute git without argument (which fortunately isn't serious, he'll just get the help message for git, which is unhelpful but not dangerous). My knowledge in Unix isn't sufficient to be sure there's no way at all to call git in a dangerous way here. With git-shell, it's much simpler to understand: either you give -c, and you get the restricted command set, or you don't, and you get nothing.

-- 
Matthieu