From d07b733aa45316661736d6a68d3d5b2bdaae1e89 Mon Sep 17 00:00:00 2001 From: "R. Steve McKown" Date: Sun, 23 Sep 2012 13:19:09 -0600 Subject: [PATCH] Some support for a future git acl implementation. The config file will be git-acl.cfg in the home directory of the owner as defined in /etc/repo_shell.cfg. --- repo_shell.c | 41 ++++++++++++++++++++++++++++++++--------- 1 file changed, 32 insertions(+), 9 deletions(-) diff --git a/repo_shell.c b/repo_shell.c index 35edbe7..e11bf54 100644 --- a/repo_shell.c +++ b/repo_shell.c @@ -10,6 +10,7 @@ #include "ini.h" #define CFG_FILE "/etc/repo_shell.cfg" +#define GIT_ACL_FILE "git_acl.cfg" typedef struct { char *svn_root; @@ -146,17 +147,39 @@ static int check_ssh_interactive(uid_t uid) return 1; /* for now */ } -static int git_check_access(const char *cmd, const char *arg, const char *user) +static int git_acl(const char *user, const char *repo) { - /* TODO: Read some configuration file which maps users and access - * to a boolean true/false value. - * - * The git command can support read and write. - * git-receive-pack is ok for readers and writers - * git-upload-pack is ok only for writers - * git-upload-archive is ok only for writers + /* TODO: Read GIT_ACL_FILE from cfg.owner's home directory. Look for + * the access level afforded user for repo. A return of 0 means no + * access, a return of 1 means read only, and a return of 2 means + * read/write. */ - return 1; /* assume OK for now */ + struct passwd *pw; + char *file; + int len = strlen(cfg.owner) + strlen(GIT_ACL_FILE) + 8; + + pw = getpwnam(cfg.owner); + if (!pw) + die("owner %s has no passwd entry?", cfg.owner); + len = strlen(pw->pw_dir) + strlen(GIT_ACL_FILE) + 2; + file = xmalloc(sizeof(char) * len); + sprintf(file, "%s/%s", pw->pw_dir, GIT_ACL_FILE); + fprintf(stderr, "[someday check %s]\n", file); + free(file); + return 2; /* assume read/write for now */ +} + +static int git_check_access(const char *cmd, const char *repo, const char *user) +{ + int rw = 1; /* 0=no access, 1=read only, 2=read/write */ + + /* What access is required per the incoming command? */ + if (!strcmp(cmd, "git-upload-pack") || + !strcmp(cmd, "git-upload-archive")) + rw = 2; + + /* Return true (1) if the user permissions >= those required */ + return (git_acl(user, repo) >= rw) ? 1 : 0; } static int do_git_cmd(const char *cmd, char *arg, char *user) -- 2.39.2