bin/git-shell-verify

   1 #!/bin/sh
   2 #
   3 # Abort any push early if the pushing user doesn't have any push permissions
   4 # at all.  This avoids unnecessary traffic and unpacked object pollution.
   5 #
   6 # This script is intended for use from within the chroot jail and may or may
   7 # not work properly outside it.
   8
   9 set -e
  10
  11 # git_add_config "some.var=value"
  12 # every ' in value must be replaced with the 4-character sequence '\'' before
  13 # calling this function or Git will barf.  Will not be effective unless running
  14 # Git version 1.7.3 or later.
  15 git_add_config() {
  16         GIT_CONFIG_PARAMETERS="${GIT_CONFIG_PARAMETERS:+$GIT_CONFIG_PARAMETERS }'$1'"
  17         export GIT_CONFIG_PARAMETERS
  18 }
  19
  20 GIT_CONFIG_NOSYSTEM=1
  21 GIT_ATTR_NOSYSTEM=1
  22 GIT_NO_REPLACE_OBJECTS=1
  23 GIT_TERMINAL_PROMPT=0
  24
  25 if ! [ -x @perlbin@ ]; then
  26         # We are INSIDE the chroot
  27         reporoot=/@jailreporoot@
  28         XDG_CONFIG_HOME=/var/empty
  29         HOME=/etc/girocco
  30         GIT_ASKPASS=/bin/git-askpass-password
  31 else
  32         # We are NOT INSIDE the chroot
  33         reporoot=@reporoot@
  34         XDG_CONFIG_HOME=@chroot@/var/empty
  35         HOME=@chroot@/etc/girocco
  36         GIT_ASKPASS=@basedir@/bin/git-askpass-password
  37 fi
  38 mob=@mob@
  39 webadmurl=@webadmurl@
  40 ua=@git_server_ua@
  41 defined_ua=@defined_git_server_ua@
  42
  43 export XDG_CONFIG_HOME
  44 export HOME
  45 export GIT_CONFIG_NOSYSTEM
  46 export GIT_ATTR_NOSYSTEM
  47 export GIT_NO_REPLACE_OBJECTS
  48 export GIT_TERMINAL_PROMPT
  49 export GIT_ASKPASS
  50 unset GIT_USER_AGENT
  51 unset GIT_HTTP_USER_AGENT
  52 if [ -n "$defined_ua" ]; then
  53         GIT_USER_AGENT="$ua"
  54         export GIT_USER_AGENT
  55         GIT_HTTP_USER_AGENT="$ua"
  56         export GIT_HTTP_USER_AGENT
  57 fi
  58
  59 # Only the following commands are allowed:
  60 #
  61 #   git-shell -c "git-receive-pack 'dir'"
  62 #   git-shell -c "git receive-pack 'dir'"
  63 #   git-shell -c "git-upload-pack 'dir'"
  64 #   git-shell -c "git upload-pack 'dir'"
  65 #   git-shell -c "git-upload-archive 'dir'"
  66 #   git-shell -c "git upload-archive 'dir'"
  67 #
  68 # where dir must start with $reporoot/ but a leading/trailing '/' is optional
  69 # as well as the final .git however if $dir does not start with $reporoot but
  70 # adding a $reporoot prefix makes it work then the $reporoot prefix will be
  71 # silently added.
  72
  73 if [ "$1" != "-c" ]; then
  74         echo forbidden >&2
  75         exit 1
  76 fi
  77
  78 dir="$2"
  79 type=''
  80 case "$2" in
  81         "git-receive-pack "*)   type='receive-pack';   dir="${dir#git-receive-pack }";;
  82         "git receive-pack "*)   type='receive-pack';   dir="${dir#git receive-pack }";;
  83         "git-upload-pack "*)    type='upload-pack';    dir="${dir#git-upload-pack }";;
  84         "git upload-pack "*)    type='upload-pack';    dir="${dir#git upload-pack }";;
  85         "git-upload-archive "*) type='upload-archive'; dir="${dir#git-upload-archive }";;
  86         "git upload-archive "*) type='upload-archive'; dir="${dir#git upload-archive }";;
  87         *)
  88                 echo forbidden >&2
  89                 exit 1
  90 esac
  91
  92 # valid project names only allow 0-9A-Za-z._+- plus the / separator and they
  93 # are always single quoted so the only valid directory names will always start
  94 # with a single quote and end with a single quote and not contain any internal
  95 # character that needs to be escaped.
  96
  97 case "$dir" in
  98         "'"*) :;;
  99         *)
 100                 echo forbidden >&2
 101                 exit 1
 102 esac
 103 case "$dir" in
 104         *"'") :;;
 105         *)
 106                 echo forbidden >&2
 107                 exit 1
 108 esac
 109
 110 # Some shells do not properly handle quoting after # or % so we cannot
 111 # put an explicit ' there in a way that works for all shells.  Instead
 112 # just remove a single character since we've already verified it's a '.
 113 dir="${dir#?}"; dir="${dir%?}"
 114
 115 # add a missing leading /
 116 case "$dir" in
 117         /*) :;;
 118         *)
 119                 dir="/$dir"
 120 esac
 121
 122 # remove a trailing /
 123 case "$dir" in
 124         *?/)
 125                 dir="${dir%/}"
 126 esac
 127
 128 # add a missing trailing .git
 129 case "$dir" in
 130         *.git) :;;
 131         *)
 132                 dir="$dir.git"
 133 esac
 134
 135 # do not allow any .. sequence
 136 case "$dir" in *..*)
 137         echo forbidden >&2
 138         exit 1
 139 esac
 140
 141 case "$dir" in
 142         "$reporoot/"*) :;;
 143         *)
 144                 # Allow it if prefixing with $reporoot matches an existing directory
 145                 if [ -d "$reporoot$dir" ]; then
 146                         dir="$reporoot$dir"
 147                 else
 148                         echo forbidden >&2
 149                         exit 1
 150                 fi
 151 esac
 152
 153 # Valid project names never end in .git (we add that automagically), so a valid
 154 # fork can never have .git at the end of any path component except the last.
 155 # We check this to avoid a situation where a certain collection of pushed refs
 156 # could be mistaken for a GIT_DIR.  Git would ultimately complain, but some
 157 # undesirable things could happen along the way.
 158
 159 # Remove the leading $reporoot and trailing .git to get a test string
 160 testpath="${dir#$reporoot/}"
 161 testpath="${testpath%.git}"
 162 case "$testpath/" in *.[Gg][Ii][Tt]/*|_*)
 163         echo forbidden >&2
 164         exit 1
 165 esac
 166
 167 if ! [ -d "$dir" ] || ! [ -f "$dir/HEAD" ] || ! [ -d "$dir/objects" ]; then
 168         echo forbidden >&2
 169         exit 1
 170 fi
 171
 172 proj="${dir#$reporoot/}"; projbare="${proj%.git}"
 173
 174 if [ "$type" = 'receive-pack' ] && ! [ -f "$dir/.nofetch" ]; then
 175         echo "The $proj project is a mirror and may not be pushed to, sorry" >&2
 176         exit 3
 177 fi
 178
 179 if [ "$type" = 'receive-pack' ]; then
 180         git_add_config 'receive.unpackLimit=1'
 181         # Note the git config documentation is wrong
 182         # transfer.unpackLimit, if set, overrides receive.unpackLimit
 183         git_add_config 'transfer.unpackLimit=1'
 184 fi
 185
 186 if ! [ -x @perlbin@ ] && [ "$type" = 'receive-pack' ]; then
 187         # We are INSIDE the chroot trying to push
 188
 189         if ! can_user_push "$projbare"; then
 190                 # If mob is enabled and mob has push permissions and
 191                 # the current user is not the mob then it's a personal mob push
 192                 # presuming the special mob directory has been set up
 193                 if [ "$mob" = "mob" -a "$LOGNAME" != "mob" -a -d "$reporoot/$proj/mob" ] &&
 194                                                                 can_user_push "$projbare" mob; then
 195                         (
 196                                 umask 113
 197                                 > "/etc/sshactive/${LOGNAME},"
 198                                 mv -f "/etc/sshactive/${LOGNAME}," "/etc/sshactive/${LOGNAME}"
 199                                 ! [ -e "$dir/.delaygc" ] || > "$dir/.allowgc" || :
 200                         )
 201                         exec git-shell -c "git-receive-pack '$reporoot/$proj/mob'"
 202                         exit 1
 203                 fi
 204                 echo "The user '$LOGNAME' does not have push permissions for project '$proj'" >&2
 205                 echo "You may adjust push permissions at $webadmurl/editproj.cgi?name=$proj" >&2
 206                 exit 3
 207         fi
 208         (
 209                 umask 113
 210                 > "/etc/sshactive/${LOGNAME},"
 211                 mv -f "/etc/sshactive/${LOGNAME}," "/etc/sshactive/${LOGNAME}"
 212                 ! [ -e "$dir/.delaygc" ] || > "$dir/.allowgc" || :
 213         )
 214 fi
 215
 216 exec git-shell -c "git-$type '$dir'"
 217 exit 1