/etc/repo_shell.cfg -> /etc/repo_shell.conf

[repo_shell.git] / repo_shell.c

diff --git a/repo_shell.c b/repo_shell.c
index 1361bf2e84e85960e3c44ac9ad095cb1394044dd..2785b848a85f89af063f280c57a9003f8c7ac928 100644 (file)
--- a/repo_shell.c
+++ b/repo_shell.c
@@ -12,32 +12,30 @@
 #include "utility.h"
 #include "version.h"
 #include "git_acl.h"
+#include "stringutils.h"
 
-#define CFG_FILE "/etc/repo_shell.cfg"
+#define CFG_FILE "/etc/repo_shell.conf"
 #define SHELL "/bin/bash"
 
 typedef struct {
+  char *user;
   char *svn_root;
   char *git_root;
   char *owner;
   char *git_acl_file;
+  bool allow_interactive;
 } cfg_t;
 
 static cfg_t cfg;
 
-static uid_t user_uid(char *user)
+/* This is the function for which setuid root is needed for repo_shell */
+static void change_user(char *user)
 {
   struct passwd *pw = getpwnam(user);
 
   if (!pw)
-    die("invalid user %s", user);
-  return pw->pw_uid;
-}
-
-static void change_user(char *user)
-{
-  /* This is the function for which setuid is required, as root */
-  setuid(user_uid(user));
+    die("invalid user %s", pw->pw_name);
+  setuid(pw->pw_uid);
 }
 
 static char *dequote(char *arg)
@@ -58,7 +56,7 @@ static char *dequote(char *arg)
 static char *add_prefix(char *prefix, char* arg)
 {
   char *narg = arg;
-        int i;
+  int i;
 
   if (arg && prefix && (i = strlen(prefix))) {
     narg = xmalloc(sizeof(char *) * (i + strlen(arg) + 2));
@@ -69,15 +67,6 @@ static char *add_prefix(char *prefix, char* arg)
   return narg;
 }
 
-static int check_ssh_interactive(uid_t uid)
-{
-  /* TODO: Check the config file for the user owning uid to see if that
-   * user should be able to execute any commands other than those required
-   * to support repository access.  Return a boolean true/false.
-   */
-  return 1; /* for now */
-}
-
 /* Return true if the user's permissions >= those required */
 static bool git_check_access(const char *cmd, const char *repo,
     const char *user)
@@ -113,6 +102,7 @@ static int do_git_cmd(const char *cmd, char *arg, char *user)
 
   ret = execvp(nargv[0], (char *const *) nargv);
   /* Code unreached if execv successful */
+  free((char*)nargv[1]);
   free(narg);
   return ret;
 }
@@ -161,6 +151,8 @@ static int ini_handler(void* user, const char* section, const char* name,
     pconfig->owner = xstrdup(value);
   else if (!strcmp(name, "git_acl_file"))
     pconfig->git_acl_file = xstrdup(value);
+  else if (!strcmp(name, "allow_interactive"))
+    pconfig->allow_interactive = str_has_word(value, pconfig->user);
   else
     return 0;  /* unknown section/name, error */
   return 1;
@@ -173,6 +165,7 @@ int main(int argc, char **argv)
   struct commands *cmd;
   int devnull_fd;
   int count;
+  struct passwd *pw;
 
   /*
    * Always open file descriptors 0/1/2 to avoid clobbering files
@@ -191,18 +184,28 @@ int main(int argc, char **argv)
     return 0;
   }
 
-  if (argc == 1 && check_ssh_interactive(getuid())) {
+  pw = getpwuid(getuid());
+  cfg.user = xstrdup(pw->pw_name);
+  if (ini_parse(CFG_FILE, ini_handler, &cfg) < 0)
+    die("cannot read config file %s", CFG_FILE);
+
+  if (argc == 1) {
+    if (!cfg.allow_interactive) {
+      fprintf(stderr, "\n");
+      die("only repository access is allowed");
+    }
     setuid(getuid());
     argv[0] = SHELL;
     execvp(argv[0], (char *const *) argv);
+    return 1;
   }
 
-  if (ini_parse(CFG_FILE, ini_handler, &cfg) < 0)
-    die("cannot read config file %s", CFG_FILE);
+  if ((!strcmp(argv[1], "-t") || !strcmp(argv[1], "--test"))) {
+    perms_t p;
 
-  if (argc == 4 && (!strcmp(argv[1], "-t") ||
-      !strcmp(argv[1], "--test"))) {
-    perms_t p = git_acl(argv[2], argv[3], cfg.git_acl_file);
+    if (argc !=4)
+      die("usage: %s -t <user> <repo>", argv[0]);
+    p = git_acl(argv[2], argv[3], cfg.git_acl_file);
     fprintf(stderr,
         "user '%s' repo '%s' perms '%s'\n  via userid '%s' repoid '%s'\n",
         argv[2], argv[3], git_acl_perms_as_str(p), git_acl_last_userid(),
@@ -210,36 +213,38 @@ int main(int argc, char **argv)
     return 0;
   }
 
-  prog = xstrdup(argv[2]);
-  if (!strncmp(prog, "git", 3) && isspace(prog[3]))
-    /* Accept "git foo" as if the caller said "git-foo". */
-    prog[3] = '-';
-
-  for (cmd = cmd_list ; cmd->name ; cmd++) {
-    int len = strlen(cmd->name);
-    char *arg;
-    struct passwd *pw;
-    if (strncmp(cmd->name, prog, len))
-      continue;
-    arg = NULL;
-    switch (prog[len]) {
-    case '\0':
+  if (argc == 3) {
+    /* argv[0] = repo_shell, argv[1] = -c, argv[2] = cmd
+     * cmd = "svnserve -t" or "git-xxx '/path/to/repo.git'"
+     */
+    prog = xstrdup(argv[2]);
+    if (!strncmp(prog, "git", 3) && isspace(prog[3]))
+      /* Accept "git foo" as if the caller said "git-foo". */
+      prog[3] = '-';
+
+    for (cmd = cmd_list ; cmd->name ; cmd++) {
+      int len = strlen(cmd->name);
+      char *arg;
+      if (strncmp(cmd->name, prog, len))
+        continue;
       arg = NULL;
-      break;
-    case ' ':
-      arg = prog + len + 1;
-      break;
-    default:
-      continue;
+      switch (prog[len]) {
+        case '\0':
+          arg = NULL;
+          break;
+        case ' ':
+          arg = prog + len + 1;
+          break;
+        default:
+          continue;
+      }
+
+      exit(cmd->exec(cmd->name, arg, cfg.user));
     }
-
-    pw = getpwuid(getuid());
-    exit(cmd->exec(cmd->name, arg, pw->pw_name));
   }
 
-  if (!check_ssh_interactive(getuid()))
+  if (!cfg.allow_interactive)
     die("only repository access is allowed");
-
   setuid(getuid());
   cd_to_homedir();
   argv[0] = SHELL;