git-shell: Add 'git-upload-archive' to allowed commands.
PATCH 1/1 git-shell: Add 'git-upload-archive' to allowed commands.
This allows for example gitosis to allow use of 'git archive --remote' in a controlled environment.
---
There were some questions on IRC raising (valid) concerns about security. If there is a dangling commit on the remote end and any user would know or guess the SHA, it could be retrieved where git-upload-pack will not allow so.
We were unable to find out if this was the original reason git-shell was never extended with git-upload-archive functionality or if it was a simple oversight. If it was the reason I'm not sure there is an easy way out.
Documentation/git-shell.txt | 6 +++--- shell.c | 1 + 2 files changed, 4 insertions(+), 3 deletions(-)
Documentation/git-shell.txt +3 -3
@@ -18,9 +18,9 @@ of server-side GIT commands implementing the pull/push functionality. The commands can be executed only by the '-c' option; the shell is not interactive. -Currently, only three commands are permitted to be called, 'git-receive-pack' -'git-upload-pack' with a single required argument or 'cvs server' (to invoke -'git-cvsserver'). +Currently, only four commands are permitted to be called, 'git-receive-pack' +'git-upload-pack' and 'git-upload-archive' with a single required argument, or +'cvs server' (to invoke 'git-cvsserver'). Author ------
shell.c +1 -0
@@ -40,6 +40,7 @@ static struct commands { } cmd_list[] = { { "git-receive-pack", do_generic_cmd }, { "git-upload-pack", do_generic_cmd }, + { "git-upload-archive", do_generic_cmd }, { "cvs", do_cvs_cmd }, { NULL }, };
Signature · 1 line
1.6.2.1.519.gcf01bc
Quoted 6 lines · Erik Broes
This allows for example gitosis to allow use of 'git archive --remote' in a controlled environment.
Signed-off-by Erik Broes <[email protected]>---
Quoted 8 lines
There were some questions on IRC raising (valid) concerns about security. If there is a dangling commit on the remote end and any user would know or guess the SHA, it could be retrieved where git-upload-pack will not allow so.
We were unable to find out if this was the original reason git-shell was never extended with git-upload-archive functionality or if it was a simple oversight. If it was the reason I'm not sure there is an easy way out.
Can't the "security concern" be addressed by whatever creates the controlled environment (e.g. gitosis)? For example, git-daemon can be configured to service upload-archive request, so I do not think it is such a bad idea to make this available if the site owner wants to use it.
Quoted 4 lines
Can't the "security concern" be addressed by whatever creates the controlled environment (e.g. gitosis)? For example, git-daemon can be configured to service upload-archive request, so I do not think it is such a bad idea to make this available if the site owner wants to use it.
I completely agree. :)
Signature · 3 lines
Erik Broes Database Group RIPE NCC
Quoted 13 lines · Junio C Hamano
Quoted 11 lines · Erik Broes
This allows for example gitosis to allow use of 'git archive --remote' in a controlled environment.
Signed-off-by Erik Broes <[email protected]>---
There were some questions on IRC raising (valid) concerns about security. If there is a dangling commit on the remote end and any user would know or guess the SHA, it could be retrieved where git-upload-pack will not allow so.
Quoted 8 lines
Quoted 3 lines
We were unable to find out if this was the original reason git-shell was never extended with git-upload-archive functionality or if it was a simple oversight. If it was the reason I'm not sure there is an easy way out.
Can't the "security concern" be addressed by whatever creates the controlled environment (e.g. gitosis)? For example, git-daemon can be configured to service upload-archive request, so I do not think it is such a bad idea to make this available if the site owner wants to use it.
But what about users that just have their shell set to git-shell? IIRC around 1.6.0 we had some reports about broken setups because git-shell had been moved to libexec. So apparently there are such setups, and the change would weaken the restrictions for them.
Hm?
Björn