threads / discuss / 35655

hooks scripts and noexec partition

Subject: hooks scripts and noexec partition

## tl;dr

4 messages between Jan 14, 2014 and Dec 17, 2014.

replies: 3people: 2as markdown or json

krzf83@gmail.com· Jan 14, 2014, 15:41 UTC · lore

git can't execute hooks no partitions mounted with noexec - even if those are just scripts with shebang line and they actualy work by hooks/./post-comit (because I use small patch on kernel that allows running scripts that way on noexec partition)

fs/exec.c

// error = -EACCES; // if (file->f_path.mnt->mnt_flags & MNT_NOEXEC) // goto exit; ... // if (file->f_path.mnt->mnt_flags & MNT_NOEXEC) // goto exit;

Jeff King· Jan 15, 2014, 09:16 UTC · re: krzf83@gmail.com · lore

Re: hooks scripts and noexec partition

On Tue, Jan 14, 2014 at 04:41:03PM +0100, krzf83@gmail.com  wrote:

> git can't execute hooks no partitions mounted with noexec - even if
> those are just scripts with shebang line

Right. Git does not know that they are shell (or other) scripts; they could be anything, and the advertised interface is that git will run exec on them (and it is explicitly OK for them to exist but not be executable, and git takes this as a sign that they are inactive).

> and they actualy work by
> hooks/./post-comit (because I use small patch on kernel that allows
> running scripts that way on noexec partition)

If you are suggesting that git always execute them as "hooks/./$hook", that might make sense if such behavior is widespread. But it sounds like you are running a custom kernel patch to get around the noexec setting. Here is the custom git patch to match it. :)

diff --git a/run-command.c b/run-command.c
index 3914d9c..ae84e87 100644
--- a/run-command.c
+++ b/run-command.c
@@ -753,7 +753,7 @@ int finish_async(struct async *async)
 
 char *find_hook(const char *name)
 {
-	char *path = git_path("hooks/%s", name);
+	char *path = git_path("hooks/./%s", name);
 	if (access(path, X_OK) < 0)
 		path = NULL;
 

-Peff

krzf83@gmail.com· Dec 14, 2014, 01:44 UTC · re: Jeff King · lore

Re: hooks scripts and noexec partition

Thanks for the patch, however it is not working (no change, hooks still dont work on noexec partition). Since I see that you are fluent in git code and C can you by any chance tell me how to modify run-command.c to make git run hooks as: /bin/sh <hook_path> ?

2014-01-15 10:16 GMT+01:00 Jeff King <peff@peff.net>:

Show 34 quoted lines

> On Tue, Jan 14, 2014 at 04:41:03PM +0100, krzf83@gmail.com  wrote:
>
>> git can't execute hooks no partitions mounted with noexec - even if
>> those are just scripts with shebang line
>
> Right. Git does not know that they are shell (or other) scripts; they
> could be anything, and the advertised interface is that git will run
> exec on them (and it is explicitly OK for them to exist but not be
> executable, and git takes this as a sign that they are inactive).
>
>> and they actualy work by
>> hooks/./post-comit (because I use small patch on kernel that allows
>> running scripts that way on noexec partition)
>
> If you are suggesting that git always execute them as "hooks/./$hook",
> that might make sense if such behavior is widespread. But it sounds like
> you are running a custom kernel patch to get around the noexec setting.
> Here is the custom git patch to match it. :)
>
> diff --git a/run-command.c b/run-command.c
> index 3914d9c..ae84e87 100644
> --- a/run-command.c
> +++ b/run-command.c
> @@ -753,7 +753,7 @@ int finish_async(struct async *async)
>
>  char *find_hook(const char *name)
>  {
> -       char *path = git_path("hooks/%s", name);
> +       char *path = git_path("hooks/./%s", name);
>         if (access(path, X_OK) < 0)
>                 path = NULL;
>
>
> -Peff

Jeff King· Dec 17, 2014, 03:03 UTC · re: krzf83@gmail.com · lore

Re: hooks scripts and noexec partition

On Sun, Dec 14, 2014 at 02:44:35AM +0100, krzf83@gmail.com  wrote:

> Thanks for the patch, however it is not working (no change, hooks
> still dont work on noexec partition). Since I see that you are fluent
> in git code and C can you by any chance tell me how to modify
> run-command.c to make git run hooks as: /bin/sh <hook_path> ?

I do not think that is a smart thing to do in general, as there is no guarantee that the hook is in fact a shell script (and not a binary, or some other scripting language). But if you want do a one-off patch for yourself, knowing that you will only use shell scripts, it is probably something like:

diff --git a/run-command.c b/run-command.c
index a476999..ccfccf0 100644
--- a/run-command.c
+++ b/run-command.c
@@ -812,6 +812,7 @@ int run_hook_ve(const char *const *env, const char *name, va_list args)
 	if (!p)
 		return 0;
 
+	argv_array_push(&hook.args, "/bin/sh");
 	argv_array_push(&hook.args, p);
 	while ((p = va_arg(args, const char *)))
 		argv_array_push(&hook.args, p);

-Peff