Commit graph

303 commits

Author SHA1 Message Date
Sitaram Chamarty 09195afd44 document deny rules a bit better 2010-02-01 15:59:03 +05:30
Sitaram Chamarty 43da598c08 auth: minor flow change when defaulting to "info" 2010-02-01 15:59:03 +05:30
Sitaram Chamarty 20c29c0145 rsync: log the command used 2010-02-01 15:59:00 +05:30
Sitaram Chamarty 18312de77a rsync: add support for delete/partial 2010-02-01 11:50:33 +05:30
Sitaram Chamarty 98a4c79dce (read this in full) access control for non-git commands running over ssh
This is actually a pretty big deal, and I am seriously starting wonder
if calling this "gito*lite*" is justified anymore.

Anyway, in for a penny, in for a pound...

This patch implements a generic way to allow access control for external
commands, as long as they are invoked via ssh and present a server-side
command that contains enough information to make an access control
decision.

The first (and only, so far) such command implemented is rsync.

Please read the changes in this commit (at least the ones in conf/ and
doc/) carefully.
2010-02-01 11:49:21 +05:30
Sitaram Chamarty 17c8075de7 Merge branch 'master' into wildrepos
factor out log_it and check_ref; update hook now requires gitolite.pm

Conflicts:
	src/hooks/update
2010-02-01 11:00:44 +05:30
Sitaram Chamarty 7f203fc020 update-hook/pm: made check_ref a common sub 2010-02-01 10:52:55 +05:30
Sitaram Chamarty 0b960cfae2 auth/update-hook/pm: make &log() a common function 2010-02-01 10:52:55 +05:30
Sitaram Chamarty 29260476fb Merge branch 'master' into pu-wildrepos 2010-02-01 10:48:17 +05:30
Sitaram Chamarty 90fed77927 Merge remote branch 'origin/pu' 2010-02-01 10:44:48 +05:30
Sitaram Chamarty b4a65ab73c doc/3: couple of clarifications
- deny rules only apply to "W" ops
  - be more specific about what allows "R" to pass
2010-01-30 08:35:43 +05:30
Sitaram Chamarty bc0a478e64 auth: minor fix to reporting on wildcard repos
Mpenz asked what would happen if the config looked like

    repo foo/abc
        R   sitaram

    repo foo/.*
        RW  sitaram

If you asked for an expand of '.*', it would pick up permissions from
the second set (i.e., "RW") and print them against "foo/abc".

This is misleading, since those are not the permissions that will
actually be *used*.  Gitolite always uses the more specific form if it
is given, which means your actual permissions are just "R".

This patch is to prevent that misleading reporting in this corner case.
2010-01-30 05:06:16 +05:30
Sitaram Chamarty 4142be4e59 auth: reporting changes for wildcard-created repos
- see *all* wildcard repos you have access to (this uses line-anchored
    regexes as described in doc/4).  Examples:
        ssh git@server expand '.*'
        ssh git@server expand 'assignment.*'

  - show perms like the info command does

Please see comments against 02cee1d for more details and caveats.
2010-01-29 16:37:34 +05:30
Sitaram Chamarty 76f8615a92 Merge branch 'pu' into pu-wildrepos 2010-01-29 09:12:24 +05:30
Teemu Matilainen 9c171d166d "expand" should print to SDTOUT instead of STDERR
Other ssh commands where fixed in 15475f666c,
but "expand" was somehow missed.

Signed-off-by: Teemu Matilainen <teemu.matilainen@reaktor.fi>
2010-01-28 22:18:12 +02:00
Sitaram Chamarty 98d73965b6 easy install: two rc file update bugs fixed
The "msysgit doesnt have 'comm'" commit (from 2 days ago), had 2 bugs:

  - (smaller) the "+++" which was part of the diff header was triggering
    a spurious rc file "new variables" warning, but there were no actual
    variables to update
  - (bigger) worse, the grep command, when there were no matches,
    coupled with the "set -e" to kill the program right there (ouch!)
2010-01-27 19:42:58 +05:30
Sitaram Chamarty 7afaafc54a document the "include" mechanism 2010-01-27 16:48:56 +05:30
Sitaram Chamarty 0fbe739772 (rats! msysgit doesnt have 'comm'...) 2010-01-25 14:36:02 +05:30
Sitaram Chamarty c3ec349721 sshkeys-lint: new program
run without arguments for usage
2010-01-25 13:17:14 +05:30
Sitaram Chamarty 11e8ab048a doc/6 revamp: minor addition 2010-01-25 09:53:13 +05:30
Sitaram Chamarty c8d4aef460 compile: allow "#" in *simple* strings
like: config notify.ircChannel = "#foo"

(thanks, jhelwig)
2010-01-23 16:56:04 +05:30
Sitaram Chamarty e68d76f127 doc/6 revamp; would appreciate reviews ;-) 2010-01-22 20:28:35 +05:30
Sitaram Chamarty c1de05a8a5 doc/3: gitweb integ; trailing slash on $projectroot
It's not clear whether $projectroot has or does not have a trailing
slash.  Current code assumes it does, but we need to cater for it not
having one also.  Otherwise the final reponame ends up with a leading
slash, once $projectroot has been stripped from the beginning of the
full repo path.
2010-01-22 06:15:34 +05:30
Sitaram Chamarty 716681a0ce Merge branch 'master' into wildrepos
major changes brought in:

    compile: disallow multiple pubkeys in one file
2010-01-17 16:47:34 +05:30
Sitaram Chamarty 645ab77af5 compile: disallow multiple pubkeys in one file
The way pubkey files are handled by gitolite, this could be used by a
repo admin to get shell access.  It's always been there as an
undocumented emergency mechanism for an admin who lost his shell keys or
overwrote them due to not understanding ssh well enough (and it has been
so used at least once).

But not any more...

Like the @SHELL case, this reflects a shift away from treating people
with repo admin rights as eqvt to people who have shell on the server,
and systematically making the former lesser privileged than the latter.

While in most cases (including my $DAYJOB) these two may be the same
person, I am told that's not a valid assumption for others, and there've
been requests to close this potential loophole.
2010-01-17 16:31:47 +05:30
Sitaram Chamarty 261b289609 mention NAME-based restrictions in README 2010-01-15 10:40:07 +05:30
Sitaram Chamarty e7962e5eda delegation doc: minor oops
I know hardly anyone is using delegation, but if you find yourself
locked out from pushing because of this one little thing, do this:

  * on your gitolite-admin clone, add the required lines per this patch,
    and commit

  * on the server, edit ~/.gitolite/conf/gitolite.conf-compiled.pm, and
    delete the following line

        'NAME_LIMITS' => 1

    from the entry for "gitolite-admin" (if you don't know what that
    means delete *all* such lines) and save the file

  * back on your admin repo clone, do a push
2010-01-15 10:19:33 +05:30
Sitaram Chamarty d61890301f delegation doc: minor oops
I know hardly anyone is using delegation, but if you find yourself
locked out from pushing because of this one little thing, do this:

  * on your gitolite-admin clone, add the required lines per this patch,
    and commit

  * on the server, edit ~/.gitolite/conf/gitolite.conf-compiled.pm, and
    delete the following line

        'NAME_LIMITS' => 1

    from the entry for "gitolite-admin" (if you don't know what that
    means delete *all* such lines) and save the file

  * back on your admin repo clone, do a push
2010-01-15 10:18:33 +05:30
Sitaram Chamarty bede47e2db Merge branch 'master' into wildrepos
Conflicts:
	src/hooks/update
2010-01-14 20:47:04 +05:30
Sitaram Chamarty ecfd20e793 @SHELL is now $SHELL_USERS in the rc file (warning: backward compat breakage)
Stop conflating the privilege to push changes to the admin repo with the
privilege to get a shell on the server.

Please read doc/6 carefully before upgrading to this version.  Also
please ensure that the gitolite key is *not* your only means to get a
command line on the server
2010-01-14 19:35:46 +05:30
Sitaram Chamarty a9824464e5 update hook: anchor refex with ^ when matching refs
Currently, a line like

    RW  foo =   user1

allows user1 to push any ref that contains the string refs/heads/foo.
This includes refs like

    refs/heads/foo
    refs/heads/foobar
    refs/heads/foo/bar

which is fine; that is what is intended.  (You can always use foo$
instead of foo if you want to prevent the latter two).

Similarly,

    RW  refs/foo    =   user1

allows

    refs/foo
    refs/foobar
    refs/foo/bar

Now, I don't see this as a "security risk" but the fact is that this
allows someone to clutter your repo with junk like

    refs/bar/refs/heads/foo
    refs/heads/bar/refs/heads/foo

(or, with the second config line example,

    refs/bar/refs/foo
    refs/heads/bar/refs/foo
)

My personal advice is if you find someone doing that intentionally, you
should probably take him out and shoot him [*], but since now *two*
people have complained about this, here goes...

----

[*]     you don't have to take him out if you don't want to
2010-01-13 15:17:55 +05:30
Teemu Matilainen 15475f666c Fix exit codes for allowed ssh commands
gitolite specific ssh commands ("getperms", "setperms", "info" etc.)
should exit with non-error code in case of success.

Also "get/setperms" should print to STDOUT instead of STDERR.

This change is specially needed for the gitolite-tools
(http://github.com/tmatilai/gitolite-tools) to work.

Signed-off-by: Teemu Matilainen <teemu.matilainen@reaktor.fi>
2010-01-10 11:24:57 +05:30
Teemu Matilainen 6c38e30e9a compile: support "include" definition
Support config file including using:
include "filename"

If filename is not an absolute path, it is looked from the
$GL_ADMINDIR/conf/ directory.

For security reasons include is not allowed for fragments.

Signed-off-by: Teemu Matilainen <teemu.matilainen@reaktor.fi>
2010-01-10 09:50:20 +05:30
Sitaram Chamarty 839027f7a7 change delegation to NAME/ style (warning: backward compat breakage)
This is a backward incompatible change.  If you are using delegation and
you upgrade to this version, please do the following:

  * change your gitolite.conf file to use the new syntax (see
    doc/5-delegation.mkd in this commit)

  * for each branch "foo" in the gitolite-admin repo, do this:

        # (on "master" branch)
        git checkout foo -- conf/fragments/foo.conf

  * git add all those new fragments and commit to master

  * delete all the branches on your clone and the server

        # again, for each branch foo
        git branch -D foo
        git push origin :foo
2010-01-10 09:50:08 +05:30
Sitaram Chamarty 08ef3555a1 deprecation warning about old style PATH/ syntax
(this commit will probably get reverted after a suitable period has
elapsed and no one is likely to still be using the old syntax).

Forgetting to change it to NAME/ after is a security issue -- you end up
permitting stuff you don't want to!

This commit allows the old syntax but prints a warning
2010-01-09 20:31:07 +05:30
Sitaram Chamarty 7124faa9f3 NAME-based restrictions
Gitolite allows you to restrict changes by file/dir name.  The syntax
for this used "PATH/" as a prefix to denote such file/dir patterns.
This has now been changed to "NAME/" because PATH is potentially
confusing.

While this is technically a backward-incompatible change, the feature
itself was hitherto undocumented, and only a few people were using it,
so I guess it's not that bad...

Also added documentation now.
2010-01-09 20:30:53 +05:30
Sitaram Chamarty 5ad2056a9c typo fix in doc/4; thanks Teemu! 2010-01-08 06:20:19 +05:30
Sitaram Chamarty ab3c861241 Revert "easy install: needs a minor fix to accommodate auto-vivification"
This reverts commit 6576e82e33.

On oddball configs, where the shell key is reused as the gitolite key by
smart( people|-alecks), the ls-remote stops the program dead, preventing
the "git add" and "git commit" that seed the admin repo.

This makes extra work in terms of fixing it after the fact; removing it
makes the install go further, and all you need to do is (1) delete the
first line from ~/.ssh/authorized_keys on the server and (2) back on the
client do a "git clone gitolite:gitolite-admin".

OK so it needs to be removed.  Explaining that was the easy part!  The
hard part is explaining why removing it is harmless.

Look at the commit tree around that commit, and see that the commit
before that (b78a720) was partially reverted in e7e6085.  b78a720
removed the new_repo call from compile, forcing it to happen only on
auth, which forced this workaround for seeding the admin repo.

Since e7e6085 reverted that part of b78a720, giving back new_repo
functions to compile, this line of code wasn't doing any good.  QED and
all that :)
2009-12-30 22:15:58 +05:30
Sitaram Chamarty 79647078a3 auth: regex goof on my part
for those not yet able to upgrade (or until I merge this into the branch
you care about), if you have a repo called, say "bk2git", just refer to
it as "bk2git.git" in the clone command!

[Thanks to Mark Frazer for finding this...]
2009-12-25 01:13:31 +05:30
Sitaram Chamarty d03152316f install transcript 2009-12-25 01:05:21 +05:30
Sitaram Chamarty 1a80f0182d Merge branch 'master' into wildrepos 2009-12-23 20:00:56 +05:30
Sitaram Chamarty b0ce84d47f document @SHELL feature, allow "info" for all,
...but still distinguish shell folks with a small extra line telling
them they have shell access
2009-12-23 19:57:36 +05:30
Sitaram Chamarty 9c3abb20e1 easy install: minor user message change for first-time install 2009-12-22 14:33:47 +05:30
Sitaram Chamarty 203d5690be Merge branch '@all-for-repos' into wildrepos
Conflicts:
	src/gl-compile-conf
2009-12-21 23:02:02 +05:30
Sitaram Chamarty ba3cbd7ecf doc/3, conf: document @all for repos
plus some refactoring of doc/3
2009-12-21 22:58:47 +05:30
Teemu Matilainen f37fb45144 compile: support "repo @all" definitions
"repo @all" can be used to set permissions or configurations for all
already defined repos.  (A repository is defined if it has permission
rules associated, empty "repo" stanza or "@group=..." line is not enough.)

For example to allow a backup user to clone all repos:

  # All other configuration
  [...]
  repo @all
       R = backup

Signed-off-by: Teemu Matilainen <teemu.matilainen@reaktor.fi>
2009-12-21 22:11:21 +05:30
Sitaram Chamarty 03babe7772 parse_acl (gitolite.pm): minor convenience added 2009-12-21 19:59:26 +05:30
Sitaram Chamarty 6fb2296e2c autoviv new repos by user only on "C" access
we've removed the facility of auto-viving "W" access repos when they are
not wildcards.  A wildcard pattern like foo/CREATER was
indistinguishable from a non-wildcard repo, and resolving it was
becoming kludgier and kludgier.  (See the revert in the commit before
this one for details).

As a side effect of not being able to distinguish wildcard repos from
real repos easily, the expand command now works for a normal repo too
(because we have to make it work for "foo/CREATER")
2009-12-21 19:58:36 +05:30
Sitaram Chamarty 981d693dec Revert "compile, parse_acl: treat foo/CREATER (no regex metas) correctly"
This reverts commit 33fc0a7e9f.

Was causing too much trouble with access reporting (basic and expanded)
because of the extra ^ at the start...

The paranoia referred to in that commit was this sequence:

  - admin creates a named (non wildcard) repo using config file push
  - somehow that gets deleted (OS error, corruption, ...)
  - admin just asks anyone with a current repo to push it to auto-revive
    it (because we allow people with "W" access to non-wildcard repos to
    auto-viv repos)
  - if you're treating this the same as a wildcard creation, you end up
    making this guy the "creater" of that repo, which means he can add
    users etc...

We resolve that paranois by disallowing autoviv of "W" access repos at
all...  Only "C" access repos can be autovived by a user (this will be
in the next commit)
2009-12-21 17:39:33 +05:30
Sitaram Chamarty 6f45f75ca1 minor docfix 2009-12-21 06:23:25 +05:30