bin/git-shell-verify

   1 #!/bin/sh
   2 #
   3 # Abort any push early if the pushing user doesn't have any push permissions
   4 # at all.  This avoids unnecessary traffic and unpacked object pollution.
   5 #
   6 # This script is intended for use from within the chroot jail and may or may
   7 # not work properly outside it.
   8
   9 set -e
  10
  11 # git_add_config "some.var=value"
  12 # every ' in value must be replaced with the 4-character sequence '\'' before
  13 # calling this function or Git will barf.  Will not be effective unless running
  14 # Git version 1.7.3 or later.
  15 git_add_config() {
  16         GIT_CONFIG_PARAMETERS="${GIT_CONFIG_PARAMETERS:+$GIT_CONFIG_PARAMETERS }'$1'"
  17         export GIT_CONFIG_PARAMETERS
  18 }
  19
  20 TMPDIR="/tmp"
  21 GIT_CONFIG_NOSYSTEM=1
  22 GIT_ATTR_NOSYSTEM=1
  23 GIT_NO_REPLACE_OBJECTS=1
  24 GIT_TERMINAL_PROMPT=0
  25 GIT_PAGER="cat"
  26 PAGER="cat"
  27 GIROCCO_SUPPRESS_AUTO_GC_UPDATE=1
  28
  29 if ! [ -x @perlbin@ ]; then
  30         # We are INSIDE the chroot
  31         reporoot=/@jailreporoot@
  32         XDG_CONFIG_HOME=/var/empty
  33         HOME=/etc/girocco
  34         GIT_ASKPASS=/bin/git-askpass-password
  35 else
  36         # We are NOT INSIDE the chroot
  37         reporoot=@reporoot@
  38         XDG_CONFIG_HOME=@chroot@/var/empty
  39         HOME=@chroot@/etc/girocco
  40         GIT_ASKPASS=@basedir@/bin/git-askpass-password
  41 fi
  42 mob=@mob@
  43 webadmurl=@webadmurl@
  44 ua=@git_server_ua@
  45 defined_ua=@defined_git_server_ua@
  46 cfg_git_no_mmap=@git_no_mmap@
  47 var_big_file_threshold=@big_file_threshold@
  48 var_upload_window=@upload_pack_window@
  49 cfg_fetch_stash_refs=@fetch_stash_refs@
  50
  51 export XDG_CONFIG_HOME
  52 export HOME
  53 export TMPDIR
  54 export GIT_CONFIG_NOSYSTEM
  55 export GIT_ATTR_NOSYSTEM
  56 export GIT_NO_REPLACE_OBJECTS
  57 export GIT_TERMINAL_PROMPT
  58 export GIT_PAGER
  59 export PAGER
  60 export GIT_ASKPASS
  61 export GIROCCO_SUPPRESS_AUTO_GC_UPDATE
  62 unset GIT_USER_AGENT
  63 unset GIT_HTTP_USER_AGENT
  64 if [ -n "$defined_ua" ]; then
  65         GIT_USER_AGENT="$ua"
  66         export GIT_USER_AGENT
  67         GIT_HTTP_USER_AGENT="$ua"
  68         export GIT_HTTP_USER_AGENT
  69 fi
  70 unset GIT_CONFIG_PARAMETERS
  71 git_add_config "core.ignoreCase=false"
  72 git_add_config "core.pager=cat"
  73 if [ -n "$cfg_git_no_mmap" ]; then
  74         # Just like compiling with NO_MMAP
  75         git_add_config "core.packedGitWindowSize=1m"
  76 else
  77         # Always use the 32-bit default (32m) even on 64-bit to avoid memory blowout
  78         git_add_config "core.packedGitWindowSize=32m"
  79 fi
  80 [ -z "$var_big_file_threshold" ] ||
  81         git_add_config "core.bigFileThreshold=$var_big_file_threshold"
  82 git_add_config "gc.auto=0"
  83
  84 if [ "${cfg_fetch_stash_refs:-0}" = "0" ]; then
  85         git_add_config "uploadpack.hiderefs=refs/stash"
  86         git_add_config "uploadpack.hiderefs=refs/tgstash"
  87 fi
  88
  89 # When accessing Git via ssh, there should never be a terminal on 0, 1 or 2
  90 # The "no-pty" flag should be set in all the ssh keys files to prevent this
  91 # However, just in case, check for it here and die as a safety fallback
  92 if [ -t 0 ] || [ -t 1 ] || [ -t 2 ]; then
  93         echo forbidden >&2
  94         exit 1
  95 fi
  96
  97 # Only the following commands are allowed:
  98 #
  99 #   git-shell -c "git-receive-pack 'dir'"
 100 #   git-shell -c "git receive-pack 'dir'"
 101 #   git-shell -c "git-upload-pack 'dir'"
 102 #   git-shell -c "git upload-pack 'dir'"
 103 #   git-shell -c "git-upload-archive 'dir'"
 104 #   git-shell -c "git upload-archive 'dir'"
 105 #
 106 # where dir must start with $reporoot/ but a leading/trailing '/' is optional
 107 # as well as the final .git however if $dir does not start with $reporoot but
 108 # adding a $reporoot prefix makes it work then the $reporoot prefix will be
 109 # silently added.
 110
 111 if [ "$1" != "-c" ]; then
 112         echo forbidden >&2
 113         exit 1
 114 fi
 115
 116 dir="$2"
 117 type=''
 118 case "$2" in
 119         "git-receive-pack "*)   type='receive-pack';   dir="${dir#git-receive-pack }";;
 120         "git receive-pack "*)   type='receive-pack';   dir="${dir#git receive-pack }";;
 121         "git-upload-pack "*)    type='upload-pack';    dir="${dir#git-upload-pack }";;
 122         "git upload-pack "*)    type='upload-pack';    dir="${dir#git upload-pack }";;
 123         "git-upload-archive "*) type='upload-archive'; dir="${dir#git-upload-archive }";;
 124         "git upload-archive "*) type='upload-archive'; dir="${dir#git upload-archive }";;
 125         *)
 126                 echo forbidden >&2
 127                 exit 1
 128 esac
 129
 130 # valid project names only allow 0-9A-Za-z._+- plus the / separator and they
 131 # are always single quoted so the only valid directory names will always start
 132 # with a single quote and end with a single quote and not contain any internal
 133 # character that needs to be escaped.
 134
 135 case "$dir" in
 136         "'"*) :;;
 137         *)
 138                 echo forbidden >&2
 139                 exit 1
 140 esac
 141 case "$dir" in
 142         *"'") :;;
 143         *)
 144                 echo forbidden >&2
 145                 exit 1
 146 esac
 147
 148 # Some shells do not properly handle quoting after # or % so we cannot
 149 # put an explicit ' there in a way that works for all shells.  Instead
 150 # just remove a single character since we've already verified it's a '.
 151 dir="${dir#?}"; dir="${dir%?}"
 152
 153 # add a missing leading /
 154 case "$dir" in
 155         /*) :;;
 156         *)
 157                 dir="/$dir"
 158 esac
 159
 160 # remove a trailing /
 161 case "$dir" in
 162         *?/)
 163                 dir="${dir%/}"
 164 esac
 165
 166 # add a missing trailing .git
 167 case "$dir" in
 168         *.git) :;;
 169         *)
 170                 dir="$dir.git"
 171 esac
 172
 173 # do not allow any .. sequence
 174 case "$dir" in *..*)
 175         echo forbidden >&2
 176         exit 1
 177 esac
 178
 179 case "$dir" in
 180         "$reporoot/"*) :;;
 181         *)
 182                 # Allow it if prefixing with $reporoot matches an existing directory
 183                 if [ -d "$reporoot$dir" ]; then
 184                         dir="$reporoot$dir"
 185                 else
 186                         echo forbidden >&2
 187                         exit 1
 188                 fi
 189 esac
 190
 191 # Valid project names never end in .git (we add that automagically), so a valid
 192 # fork can never have .git at the end of any path component except the last.
 193 # We check this to avoid a situation where a certain collection of pushed refs
 194 # could be mistaken for a GIT_DIR.  Git would ultimately complain, but some
 195 # undesirable things could happen along the way.
 196
 197 # Remove the leading $reporoot and trailing .git to get a test string
 198 testpath="${dir#$reporoot/}"
 199 testpath="${testpath%.git}"
 200 case "$testpath/" in *.[Gg][Ii][Tt]/*|_*)
 201         echo forbidden >&2
 202         exit 1
 203 esac
 204
 205 if ! [ -d "$dir" ] || ! [ -f "$dir/HEAD" ] || ! [ -d "$dir/objects" ]; then
 206         echo forbidden >&2
 207         exit 1
 208 fi
 209
 210 proj="${dir#$reporoot/}"; projbare="${proj%.git}"
 211
 212 if [ "$type" = 'receive-pack' ] && [ "$LOGNAME" = 'git' ]; then
 213         echo "The user '$LOGNAME' may only be used for fetches, sorry" >&2
 214         exit 3
 215 fi
 216
 217 if [ "$type" = 'receive-pack' ] && ! [ -f "$dir/.nofetch" ]; then
 218         echo "The $proj project is a mirror and may not be pushed to, sorry" >&2
 219         exit 3
 220 fi
 221
 222 if [ "$type" = 'receive-pack' ]; then
 223         git_add_config 'receive.unpackLimit=1'
 224         # Note the git config documentation is wrong
 225         # transfer.unpackLimit, if set, overrides receive.unpackLimit
 226         git_add_config 'transfer.unpackLimit=1'
 227 fi
 228
 229 if ! [ -x @perlbin@ ] && [ "$type" = 'receive-pack' ]; then
 230         # We are INSIDE the chroot trying to push
 231
 232         if ! can_user_push "$projbare"; then
 233                 # If mob is enabled and mob has push permissions and
 234                 # the current user is not the mob then it's a personal mob push
 235                 # presuming the special mob directory has been set up
 236                 if [ "$mob" = "mob" ] && [ "$LOGNAME" != "mob" ] && [ -d "$reporoot/$proj/mob" ] &&
 237                                                                 can_user_push "$projbare" mob; then
 238                         (
 239                                 umask 113
 240                                 >"/etc/sshactive/$LOGNAME,"
 241                                 mv -f "/etc/sshactive/$LOGNAME," "/etc/sshactive/$LOGNAME"
 242                                 ! [ -e "$dir/.delaygc" ] || >"$dir/.allowgc" || :
 243                         )
 244                         exec git-shell -c "git-receive-pack '$reporoot/$proj/mob'"
 245                         exit 1
 246                 fi
 247                 echo "The user '$LOGNAME' does not have push permissions for project '$proj'" >&2
 248                 echo "You may adjust push permissions at $webadmurl/editproj.cgi?name=$proj" >&2
 249                 exit 3
 250         fi
 251         (
 252                 umask 113
 253                 >"/etc/sshactive/$LOGNAME,"
 254                 mv -f "/etc/sshactive/$LOGNAME," "/etc/sshactive/$LOGNAME"
 255                 ! [ -e "$dir/.delaygc" ] || >"$dir/.allowgc" || :
 256         )
 257 fi
 258
 259 [ -z "$var_upload_window" ] || [ "$type" != "upload-pack" ] ||
 260         git_add_config "pack.window=$var_upload_window"
 261
 262 exec git-shell -c "git-$type '$dir'"
 263 exit 1