threads / discuss / 4446

Git-daemon messing up permissions for gitweb

Subject: Git-daemon messing up permissions for gitweb

## tl;dr

5 messages between Jun 9, 2006 and Jun 9, 2006.

replies: 4people: 4as markdown or json

Post, Mark K· Jun 9, 2006, 18:41 UTC · lore

I'm trying to set up a git repository for mainframe Linux developers to use at git390.osdl.marist.edu. Everything _seemed_ to go well, until Martin Schwidefsky started actually pushing changes back to the repository. When he does that, the projects disappear from the web page that gitweb.cgi is generating.

As far as I can tell, the problem is happening because these files are being written out with file permissions of 640, and since Apache is running as user wwwrun, it can't read them: -rw-r----- 1 sky git 5490 Jun 9 03:35 ./linux-2.6.git/info/refs -rw-r----- 1 sky git 54 Jun 9 03:35 ./linux-2.6.git/objects/info/packs -rw-r----- 1 sky git 41 Jun 9 03:35 ./linux-2.6.git/refs/heads/master -rw-r----- 1 sky git 41 Jun 9 03:35 ./linux-2.6.git/refs/heads/origin -rw-r----- 1 sky git 5490 Jun 9 04:00 ./s390-experimental.git/info/refs -rw-r----- 1 sky git 1 Jun 9 04:00 ./s390-experimental.git/objects/info/packs -rw-r----- 1 sky git 41 Jun 9 04:00 ./s390-experimental.git/refs/heads/master -rw-r----- 1 sky git 5490 Jun 9 11:31 ./s390-features.git/info/refs -rw-r----- 1 sky git 1 Jun 9 11:31 ./s390-features.git/objects/info/packs -rw-r----- 1 sky git 41 Jun 9 11:31 ./s390-features.git/refs/heads/master -rw-r----- 1 sky git 5490 Jun 9 03:41 ./s390-fixes.git/info/refs -rw-r----- 1 sky git 1 Jun 9 03:41 ./s390-fixes.git/objects/info/packs -rw-r----- 1 sky git 41 Jun 9 03:41 ./s390-fixes.git/refs/heads/master

I know I could brute-force this by adding wwwrun to the git group, but I first wanted to find out if that is the solution, or if something is wrong with the way I've set things up. I tried searching the mailing list archives, but nothing that appeared to be relevant turned up.

Thanks in advance for any help,

Mark Post

Jakub Narebski· Jun 9, 2006, 18:58 UTC · re: Post, Mark K · lore

Re: Git-daemon messing up permissions for gitweb

Post, Mark K wrote:

Show 10 quoted lines

> I'm trying to set up a git repository for mainframe Linux developers to
> use at git390.osdl.marist.edu.  Everything _seemed_ to go well, until
> Martin Schwidefsky started actually pushing changes back to the
> repository.  When he does that, the projects disappear from the web page
> that gitweb.cgi is generating.
> 
> As far as I can tell, the problem is happening because these files are
> being written out with file permissions of 640, and since Apache is
> running as user wwwrun, it can't read them:
> -rw-r-----  1 sky git  5490 Jun  9 03:35 ./linux-2.6.git/info/refs

One of the possible soultion would be to add sky to Apache group, make directory sticky-group, and make files readable by group (perhaps by marking repository as shared, or something).

-- 
Jakub Narebski
Warsaw, Poland

Linus Torvalds· Jun 9, 2006, 19:05 UTC · re: Post, Mark K · lore

Re: Git-daemon messing up permissions for gitweb

On Fri, 9 Jun 2006, Post, Mark K wrote:

>
> As far as I can tell, the problem is happening because these files are
> being written out with file permissions of 640, and since Apache is
> running as user wwwrun, it can't read them:

You can either make sure that people have something like

	umask 0022

in their bashrc (or that it's the default umask), so that they do things world-readably by default.

Or add
	[core]
		SharedRepository = true

to the repository config file.

		Linus

Junio C Hamano· Jun 9, 2006, 20:01 UTC · re: Linus Torvalds · lore

Re: Git-daemon messing up permissions for gitweb

Linus Torvalds <torvalds@osdl.org> writes:

Show 5 quoted lines

> On Fri, 9 Jun 2006, Post, Mark K wrote:
>>
>> As far as I can tell, the problem is happening because these files are
>> being written out with file permissions of 640, and since Apache is
>> running as user wwwrun, it can't read them:

Show 5 quoted lines

> Or add
> 	[core]
> 		SharedRepository = true
>
> to the repository config file.

This is about being able to share among the group, not with people outside, so if wwwrun is outside git group like Mark's setting I do not think it would do anything helpful to the situation.

Junio C Hamano· Jun 9, 2006, 19:51 UTC · re: Post, Mark K · lore

Re: Git-daemon messing up permissions for gitweb

"Post, Mark K" <mark.post@eds.com> writes:

Show 5 quoted lines

> I'm trying to set up a git repository for mainframe Linux developers to
> use at git390.osdl.marist.edu.  Everything _seemed_ to go well, until
> Martin Schwidefsky started actually pushing changes back to the
> repository.  When he does that, the projects disappear from the web page
> that gitweb.cgi is generating.

Show 7 quoted lines

> As far as I can tell, the problem is happening because these files are
> being written out with file permissions of 640, and since Apache is
> running as user wwwrun, it can't read them:
> -rw-r-----  1 sky git  5490 Jun  9 03:35 ./linux-2.6.git/info/refs
> -rw-r-----  1 sky git    54 Jun  9 03:35
> ./linux-2.6.git/objects/info/packs
> -rw-r-----  1 sky git    41 Jun  9 03:35

First of all, it is not git-daemon that is updating these refs. The daemon is a read only facility.

And you have checked the suggestion by Linus to set the umask to world readable, which brings me to the next question.

How did Martin actually "push changes back"?

Was it over git protocol over SSH, or the webdav thing over http push? The comment by Linus is about the former and I do not know offhand who webdav thing runs as or how it handles the permissino bits.

It could be that your ssh daemon installation bypasses .bashrc and uses its own .ssh/environment, in which case your user would may need to do umask there as well.