3
\$\begingroup\$

I want a git repository, accessible over ssh, to be read-only when used with certain keys. With other keys access to the full system is okay.

Here is my solution.

git-readonlyshell:

if echo "$2" | egrep -q ^git-upload-pack; then
  sh -c "$2"
else
  echo Error: read only access 1>&2
fi

.ssh/authorized_keys:

command="./git-readonlyshell -c \"$SSH_ORIGINAL_COMMAND\"" ...

Thoughts?

Any scenario in which this would break?

\$\endgroup\$
  • 2
    \$\begingroup\$ Why not just have a user that is read-only for the repository and use one user for full-access, and the other for read-only? \$\endgroup\$ – rolfl Nov 25 '13 at 4:29
  • \$\begingroup\$ @rolfl I could. But then I have to specify a longer path after the :, meaning user@server:/full/path/to/repo \$\endgroup\$ – nafg Nov 25 '13 at 4:35
  • 2
    \$\begingroup\$ @nafg: Can you please roll back your last edit if it was in response to GoodPerson's answer? The answer becomes somewhat pointless when you edit your question like this. \$\endgroup\$ – ChrisWue Nov 25 '13 at 7:34
  • 1
    \$\begingroup\$ @ChrisWue: I rolled back the edit, so that the answer makes sense again. nafg: If you want to ask a follow-up question, you should append it to the original question instead of changing your question. \$\endgroup\$ – Gareth Rees Nov 25 '13 at 10:21
  • \$\begingroup\$ @ChrisWue: trying to recall, are you talking about the fact that I added "Any scenario in which this would break?" If so no, it was no in response to GoodPerson's answer, it was my original intention and I realized I had been unclear. \$\endgroup\$ – nafg Nov 29 '13 at 7:01
5
\$\begingroup\$

Should be

printf "%s\n" "$2" | grep -E "^git-upload-pack" && sh -c "$2"

Notes:

  • sh not bash for portability
  • The printf instead of echo is for safety. What happens if someone puts "-n foo" as "$2"?
\$\endgroup\$
  • \$\begingroup\$ It is insecure. The $SSH_ORIGINAL_COMMAND can contain multiple command-lines, e.g., git-upload-pack dummy; cat /etc/passwd. \$\endgroup\$ – fumiyas Feb 28 '18 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.