On Thu, Jan 14, 2010 at 03:43:05PM -0500, Jeff King wrote: > On Thu, Jan 14, 2010 at 11:41:07AM -0800, Shawn O. Pearce wrote: > > > > Because receive-pack runs as the user who is pushing, not as the > > > repository owner. So by convincing you to push to my repository in a > > > multi-user environment, I convince you to run some arbitrary code of > > > mine. > > > > Uhhh, this was in fetch/upload-pack Peff, not push/receive-pack. > > > > Same issue though. > Errr...yeah. Sorry for the confusion. But yes, it's the same mechanism, > except that it is even easier to get people to pull from you (to get > them to push, you first have to get them to write a worthwhile code > contribution. ;) ). post-update, post-receive, update, pre-receive would all be subject to this problem as well if: - the repo was group/world-writable - the hook is untrusted post-upload-pack just required group/world-readable and untrusted hook code. I'd like to lodge a complaint about the removal of the functionality. I would have commented on the patch prior to this, but even searching I didn't see it cross the list. As a reasonable middle ground between the functionality and complete removal, can we find a way just to only execute the potentially dangerous hooks under known safe conditions or when explicitly requested by the user. Places where the hooks are safe: - the hooks are known trusted AND not writable by the user/group. (e.g. "chown -R root:root hooks/"). - Systems where the users/groups do not have full shell access, just access to run Git itself. Eg gitosis, regular git+ssh:// w/ a restricted shell. Upcoming use case: For Gentoo's work on migrating to Git, we've been working on a pre-upload-pack hook and script that can explicitly block the generation of some packs. Basically, unless you send a sufficiently recent 'have' line, you are told to fetch a bundle via HTTP or rsync instead. -- Robin Hugh Johnson Gentoo Linux: Developer, Trustee & Infrastructure Lead E-Mail : robbat2@xxxxxxxxxx GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85
Attachment:
pgprwdIkcNSlS.pgp
Description: PGP signature