# how to restrict git to specific non-root superuser 3 messages from 2012-05-05 to 2012-05-05. Participants: Neal Kreitzinger, Sitaram Chamarty. Thread: https://gitlist.dev/t/30429 ## Neal Kreitzinger, 2012-05-05 01:48 Subject: how to restrict git to specific non-root superuser Message-ID: URL: https://gitlist.dev/e/jo20t5%24e8n%241%40dough.gmane.org ``` I work on systems where 'everyone' has the root password (that problem is somewhat out of my hands). Is there a technique to setup git so that only a certain non-root superuser (ie, gittech) is allowed to run git commands? I don't want people logged in as root to mess up the git repos. I'm considering using git for deployment and some anonymous root user messing it up would be a very, very, bad thing. Maybe this proposition is theoretically impossible. Maybe someone has implemented this concept in practice. v/r, neal ``` ## Neal Kreitzinger, 2012-05-05 03:29 Subject: Re: how to restrict git to specific non-root superuser Message-ID: <4FA49EA6.8030000@gmail.com> URL: https://gitlist.dev/e/4FA49EA6.8030000%40gmail.com In-Reply-To: ``` On 5/4/2012 8:48 PM, Neal Kreitzinger wrote: > I work on systems where 'everyone' has the root password (that problem > is somewhat out of my hands). Is there a technique to setup git so that > only a certain non-root superuser (ie, gittech) is allowed to run git > commands? I don't want people logged in as root to mess up the git repos. > > I'm considering using git for deployment and some anonymous root user > messing it up would be a very, very, bad thing. Maybe this proposition > is theoretically impossible. Maybe someone has implemented this concept > in practice. > I'm thinking a way to achieve this effect is: install git under the home dir of the 'gittech' user and add that path only to the PATH of 'gittech'. have the git repos under the 'gittech' home dir with worktree(s) assigned to deployment locations. If people mess with the worktrees I will be able to tell with git status via 'gittech'. v/r, neal ``` ## Sitaram Chamarty, 2012-05-05 05:07 Subject: Re: how to restrict git to specific non-root superuser Message-ID: URL: https://gitlist.dev/e/CAMK1S_g%2BEmVe%2BxHB0TvRB0Xhk0Su1MJXyQEHfHMcqvyhjg1Gvw%40mail.gmail.com In-Reply-To: <4FA49EA6.8030000@gmail.com> ``` On Sat, May 5, 2012 at 8:59 AM, Neal Kreitzinger wrote: > On 5/4/2012 8:48 PM, Neal Kreitzinger wrote: >> >> I work on systems where 'everyone' has the root password (that problem >> is somewhat out of my hands). Is there a technique to setup git so that >> only a certain non-root superuser (ie, gittech) is allowed to run git >> commands? I don't want people logged in as root to mess up the git repos. move /usr/bin/git to some other name and replace it with this shell script: #!/bin/bash # scary message echo 'running: rm -rf /' # lots of disk activity find / >/dev/null 2>&1 Jokes apart, even though you said it is out of your hands, you actually have a very serious problem. There are no shortcuts to that one until you get burnt. Meanwhile, you could add 'update' as well as 'pre-commit' hooks (and possibly several others; check 'man githooks') using code that checks the effective userid and aborts if it is root. ("aborts" in a hook generally means the eqvt of "exit 1" but again, please check "man githooks" for details). ```