Gotweb

Blame

Date:: Mon Jul 10 19:47:10 2023 UTC
Message:: make gitwrapper ignore 'permission denied' for repository paths We recommend that gotsh users should not have direct filesystem access to repositories served by gotd. Which means admins will be setting things up as follows if public read-access should be denied: chown _gotd /git chmod 700 /git su -m _gotd -c 'gotadmin init /git/repo.git" However, gitwrapper would error out when repositories listed in gotd.conf were inaccessible to the user invoking gitwrapper: git-upload-pack: /etc/gotd.conf:2: realpath /git/repo.git: Permission denied Make gitwrapper ignore such errors as they are expected in this situation. While here, add a PROC_GITWRAPPER process ID for use as a global variable parse.y can check while special-casing any specific behaviour required by gitwrapper. (The worse alternative would have been adding a new global variable to parse.y just to control the behaviour on realpath errors.) ok op@
Actions:: History | Blob | Raw File
  1 5dcb3a43 2023-04-01 thomas /*
  2 5dcb3a43 2023-04-01 thomas  * Copyright (c) 2023 Stefan Sperling <stsp@openbsd.org>
  3 5dcb3a43 2023-04-01 thomas  *
  4 5dcb3a43 2023-04-01 thomas  * Permission to use, copy, modify, and distribute this software for any
  5 5dcb3a43 2023-04-01 thomas  * purpose with or without fee is hereby granted, provided that the above
  6 5dcb3a43 2023-04-01 thomas  * copyright notice and this permission notice appear in all copies.
  7 5dcb3a43 2023-04-01 thomas  *
  8 5dcb3a43 2023-04-01 thomas  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  9 5dcb3a43 2023-04-01 thomas  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 10 5dcb3a43 2023-04-01 thomas  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 11 5dcb3a43 2023-04-01 thomas  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 12 5dcb3a43 2023-04-01 thomas  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 13 5dcb3a43 2023-04-01 thomas  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 14 5dcb3a43 2023-04-01 thomas  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 15 5dcb3a43 2023-04-01 thomas  */
 16 5dcb3a43 2023-04-01 thomas 
 17 5dcb3a43 2023-04-01 thomas /*
 18 5dcb3a43 2023-04-01 thomas  * Resolve path namespace conflicts for git-upload-pack and git-receive-pack.
 19 5dcb3a43 2023-04-01 thomas  */
 20 5dcb3a43 2023-04-01 thomas 
 21 5dcb3a43 2023-04-01 thomas #include <sys/queue.h>
 22 5dcb3a43 2023-04-01 thomas #include <sys/types.h>
 23 5dcb3a43 2023-04-01 thomas #include <sys/uio.h>
 24 5dcb3a43 2023-04-01 thomas 
 25 5dcb3a43 2023-04-01 thomas #include <err.h>
 26 5dcb3a43 2023-04-01 thomas #include <errno.h>
 27 5dcb3a43 2023-04-01 thomas #include <event.h>
 28 5dcb3a43 2023-04-01 thomas #include <imsg.h>
 29 5dcb3a43 2023-04-01 thomas #include <limits.h>
 30 5dcb3a43 2023-04-01 thomas #include <stdio.h>
 31 5dcb3a43 2023-04-01 thomas #include <stdlib.h>
 32 5dcb3a43 2023-04-01 thomas #include <string.h>
 33 5dcb3a43 2023-04-01 thomas #include <sha1.h>
 34 5dcb3a43 2023-04-01 thomas #include <sha2.h>
 35 5dcb3a43 2023-04-01 thomas #include <syslog.h>
 36 5dcb3a43 2023-04-01 thomas #include <util.h>
 37 5dcb3a43 2023-04-01 thomas #include <unistd.h>
 38 5dcb3a43 2023-04-01 thomas 
 39 5dcb3a43 2023-04-01 thomas #include "got_error.h"
 40 5dcb3a43 2023-04-01 thomas #include "got_path.h"
 41 5dcb3a43 2023-04-01 thomas 
 42 5769f9a0 2023-04-22 thomas #include "got_lib_dial.h"
 43 5769f9a0 2023-04-22 thomas 
 44 5dcb3a43 2023-04-01 thomas #include "gotd.h"
 45 5dcb3a43 2023-04-01 thomas #include "log.h"
 46 5dcb3a43 2023-04-01 thomas 
 47 5dcb3a43 2023-04-01 thomas #ifndef GITWRAPPER_GIT_LIBEXEC_DIR
 48 5dcb3a43 2023-04-01 thomas #define GITWRAPPER_GIT_LIBEXEC_DIR "/usr/local/libexec/git"
 49 5dcb3a43 2023-04-01 thomas #endif
 50 5dcb3a43 2023-04-01 thomas 
 51 5dcb3a43 2023-04-01 thomas #ifndef GITWRAPPER_MY_SERVER_PROG
 52 5dcb3a43 2023-04-01 thomas #define GITWRAPPER_MY_SERVER_PROG "gotsh"
 53 5dcb3a43 2023-04-01 thomas #endif
 54 5dcb3a43 2023-04-01 thomas 
 55 5dcb3a43 2023-04-01 thomas 
 56 5dcb3a43 2023-04-01 thomas __dead static void
 57 5dcb3a43 2023-04-01 thomas usage(void)
 58 5dcb3a43 2023-04-01 thomas {
 59 5dcb3a43 2023-04-01 thomas 	fprintf(stderr, "usage: %s -c '%s|%s repository-path'\n",
 60 5769f9a0 2023-04-22 thomas 	    getprogname(), GOT_DIAL_CMD_SEND, GOT_DIAL_CMD_FETCH);
 61 5dcb3a43 2023-04-01 thomas 	exit(1);
 62 5dcb3a43 2023-04-01 thomas }
 63 5dcb3a43 2023-04-01 thomas 
 64 5dcb3a43 2023-04-01 thomas /*
 65 5dcb3a43 2023-04-01 thomas  * Unveil the specific programs we want to start and hide everything else.
 66 5dcb3a43 2023-04-01 thomas  * This is important to limit the impact of our "exec" pledge.
 67 5dcb3a43 2023-04-01 thomas  */
 68 5dcb3a43 2023-04-01 thomas static const struct got_error *
 69 5dcb3a43 2023-04-01 thomas apply_unveil(const char *myserver)
 70 5dcb3a43 2023-04-01 thomas {
 71 5dcb3a43 2023-04-01 thomas 	const char *fetchcmd = GITWRAPPER_GIT_LIBEXEC_DIR "/" \
 72 5769f9a0 2023-04-22 thomas 		GOT_DIAL_CMD_FETCH;
 73 5dcb3a43 2023-04-01 thomas 	const char *sendcmd = GITWRAPPER_GIT_LIBEXEC_DIR "/" \
 74 5769f9a0 2023-04-22 thomas 		GOT_DIAL_CMD_SEND;
 75 5dcb3a43 2023-04-01 thomas 
 76 5dcb3a43 2023-04-01 thomas #ifdef PROFILE
 77 5dcb3a43 2023-04-01 thomas 	if (unveil("gmon.out", "rwc") != 0)
 78 5dcb3a43 2023-04-01 thomas 		return got_error_from_errno2("unveil", "gmon.out");
 79 5dcb3a43 2023-04-01 thomas #endif
 80 768236a0 2023-05-26 thomas 	if (unveil(fetchcmd, "x") != 0 && errno != ENOENT)
 81 5dcb3a43 2023-04-01 thomas 		return got_error_from_errno2("unveil", fetchcmd);
 82 5dcb3a43 2023-04-01 thomas 
 83 768236a0 2023-05-26 thomas 	if (unveil(sendcmd, "x") != 0 && errno != ENOENT)
 84 5dcb3a43 2023-04-01 thomas 		return got_error_from_errno2("unveil", sendcmd);
 85 5dcb3a43 2023-04-01 thomas 
 86 768236a0 2023-05-26 thomas 	if (myserver && unveil(myserver, "x") != 0 && errno != ENOENT)
 87 5dcb3a43 2023-04-01 thomas 		return got_error_from_errno2("unveil", myserver);
 88 5dcb3a43 2023-04-01 thomas 
 89 5dcb3a43 2023-04-01 thomas 	if (unveil(NULL, NULL) != 0)
 90 5dcb3a43 2023-04-01 thomas 		return got_error_from_errno("unveil");
 91 5dcb3a43 2023-04-01 thomas 
 92 5dcb3a43 2023-04-01 thomas 	return NULL;
 93 5dcb3a43 2023-04-01 thomas }
 94 5dcb3a43 2023-04-01 thomas 
 95 5dcb3a43 2023-04-01 thomas int
 96 5dcb3a43 2023-04-01 thomas main(int argc, char *argv[])
 97 5dcb3a43 2023-04-01 thomas {
 98 5dcb3a43 2023-04-01 thomas 	const struct got_error *error;
 99 5dcb3a43 2023-04-01 thomas 	const char *confpath = NULL;
100 5dcb3a43 2023-04-01 thomas 	char *command = NULL, *repo_name = NULL; /* for matching gotd.conf */
101 5dcb3a43 2023-04-01 thomas 	char *myserver = NULL;
102 5dcb3a43 2023-04-01 thomas 	const char *repo_path = NULL; /* as passed on the command line */
103 5dcb3a43 2023-04-01 thomas 	const char *relpath;
104 5dcb3a43 2023-04-01 thomas 	char *gitcommand = NULL;
105 5dcb3a43 2023-04-01 thomas 	struct gotd gotd;
106 5dcb3a43 2023-04-01 thomas 	struct gotd_repo *repo = NULL;
107 5dcb3a43 2023-04-01 thomas 
108 5dcb3a43 2023-04-01 thomas 	log_init(1, LOG_USER); /* Log to stderr. */
109 5dcb3a43 2023-04-01 thomas 
110 5dcb3a43 2023-04-01 thomas #ifndef PROFILE
111 44e35bfc 2023-04-01 thomas 	if (pledge("stdio rpath exec unveil", NULL) == -1)
112 5dcb3a43 2023-04-01 thomas 		err(1, "pledge");
113 5dcb3a43 2023-04-01 thomas #endif
114 5dcb3a43 2023-04-01 thomas 
115 5dcb3a43 2023-04-01 thomas 	/*
116 5dcb3a43 2023-04-01 thomas 	 * Look up our own server program in PATH so we can unveil(2) it.
117 5dcb3a43 2023-04-01 thomas 	 * This call only errors out upon memory allocation failure.
118 5dcb3a43 2023-04-01 thomas 	 * If the program cannot be found then myserver will be set to NULL.
119 5dcb3a43 2023-04-01 thomas 	 */
120 5dcb3a43 2023-04-01 thomas 	error = got_path_find_prog(&myserver, GITWRAPPER_MY_SERVER_PROG);
121 5dcb3a43 2023-04-01 thomas 	if (error)
122 5dcb3a43 2023-04-01 thomas 		goto done;
123 5dcb3a43 2023-04-01 thomas 
124 5dcb3a43 2023-04-01 thomas 	/*
125 5dcb3a43 2023-04-01 thomas 	 * Run parse_config() before unveil(2) because parse_config()
126 5dcb3a43 2023-04-01 thomas 	 * checks whether repository paths exist on disk.
127 5dcb3a43 2023-04-01 thomas 	 * Parsing errors and warnings will be logged to stderr.
128 5dcb3a43 2023-04-01 thomas 	 * Upon failure we will run Git's native tooling so do not
129 5dcb3a43 2023-04-01 thomas 	 * bother checking for errors here.
130 5dcb3a43 2023-04-01 thomas 	 */
131 5dcb3a43 2023-04-01 thomas 	confpath = getenv("GOTD_CONF_PATH");
132 5dcb3a43 2023-04-01 thomas 	if (confpath == NULL)
133 5dcb3a43 2023-04-01 thomas 		confpath = GOTD_CONF_PATH;
134 f3807fe5 2023-07-10 thomas 	parse_config(confpath, PROC_GITWRAPPER, &gotd);
135 5dcb3a43 2023-04-01 thomas 
136 5dcb3a43 2023-04-01 thomas 	error = apply_unveil(myserver);
137 5dcb3a43 2023-04-01 thomas 	if (error)
138 5dcb3a43 2023-04-01 thomas 		goto done;
139 5dcb3a43 2023-04-01 thomas 
140 5dcb3a43 2023-04-01 thomas #ifndef PROFILE
141 44e35bfc 2023-04-01 thomas 	if (pledge("stdio exec", NULL) == -1)
142 5dcb3a43 2023-04-01 thomas 		err(1, "pledge");
143 5dcb3a43 2023-04-01 thomas #endif
144 5dcb3a43 2023-04-01 thomas 
145 5769f9a0 2023-04-22 thomas 	if (strcmp(getprogname(), GOT_DIAL_CMD_SEND) == 0 ||
146 5769f9a0 2023-04-22 thomas 	    strcmp(getprogname(), GOT_DIAL_CMD_FETCH) == 0) {
147 5dcb3a43 2023-04-01 thomas 		if (argc != 2)
148 5dcb3a43 2023-04-01 thomas 			usage();
149 5dcb3a43 2023-04-01 thomas 		command = strdup(getprogname());
150 5dcb3a43 2023-04-01 thomas 		if (command == NULL) {
151 5dcb3a43 2023-04-01 thomas 			error = got_error_from_errno("strdup");
152 5dcb3a43 2023-04-01 thomas 			goto done;
153 5dcb3a43 2023-04-01 thomas 		}
154 5dcb3a43 2023-04-01 thomas 		repo_path = argv[1];
155 5dcb3a43 2023-04-01 thomas 		relpath = argv[1];
156 5dcb3a43 2023-04-01 thomas 		while (relpath[0] == '/')
157 5dcb3a43 2023-04-01 thomas 			relpath++;
158 5dcb3a43 2023-04-01 thomas 		repo_name = strdup(relpath);
159 5dcb3a43 2023-04-01 thomas 		if (repo_name == NULL) {
160 5dcb3a43 2023-04-01 thomas 			error = got_error_from_errno("strdup");
161 5dcb3a43 2023-04-01 thomas 			goto done;
162 5dcb3a43 2023-04-01 thomas 		}
163 5dcb3a43 2023-04-01 thomas 	} else {
164 5dcb3a43 2023-04-01 thomas 		if (argc != 3 || strcmp(argv[1], "-c") != 0)
165 5dcb3a43 2023-04-01 thomas 			usage();
166 5dcb3a43 2023-04-01 thomas 		repo_path = argv[2];
167 5769f9a0 2023-04-22 thomas 		error = got_dial_parse_command(&command, &repo_name,
168 5dcb3a43 2023-04-01 thomas 		    repo_path);
169 5dcb3a43 2023-04-01 thomas 		if (error && error->code == GOT_ERR_BAD_PACKET)
170 5dcb3a43 2023-04-01 thomas 			usage();
171 5dcb3a43 2023-04-01 thomas 		if (error)
172 5dcb3a43 2023-04-01 thomas 			goto done;
173 5dcb3a43 2023-04-01 thomas 	}
174 5dcb3a43 2023-04-01 thomas 
175 5dcb3a43 2023-04-01 thomas 	repo = gotd_find_repo_by_name(repo_name, &gotd);
176 5dcb3a43 2023-04-01 thomas 
177 5dcb3a43 2023-04-01 thomas 	/*
178 9c9f0ee1 2023-04-01 thomas 	 * Invoke our custom Git server if the repository was found
179 9c9f0ee1 2023-04-01 thomas 	 * in gotd.conf. Otherwise invoke native git(1) tooling.
180 5dcb3a43 2023-04-01 thomas 	 */
181 44e35bfc 2023-04-01 thomas 	if (repo) {
182 44e35bfc 2023-04-01 thomas 		if (myserver == NULL) {
183 44e35bfc 2023-04-01 thomas 			error = got_error_fmt(GOT_ERR_NO_PROG,
184 44e35bfc 2023-04-01 thomas 			    "cannot run '%s'",
185 44e35bfc 2023-04-01 thomas 			    GITWRAPPER_MY_SERVER_PROG);
186 44e35bfc 2023-04-01 thomas 			goto done;
187 5dcb3a43 2023-04-01 thomas 		}
188 44e35bfc 2023-04-01 thomas 		execl(myserver, command, repo_name, (char *)NULL);
189 44e35bfc 2023-04-01 thomas 		error = got_error_from_errno2("execl", myserver);
190 44e35bfc 2023-04-01 thomas 	} else {
191 44e35bfc 2023-04-01 thomas 		if (asprintf(&gitcommand, "%s/%s",
192 44e35bfc 2023-04-01 thomas 		    GITWRAPPER_GIT_LIBEXEC_DIR, command) == -1) {
193 44e35bfc 2023-04-01 thomas 			error = got_error_from_errno("asprintf");
194 44e35bfc 2023-04-01 thomas 			goto done;
195 44e35bfc 2023-04-01 thomas 		}
196 44e35bfc 2023-04-01 thomas 		execl(gitcommand, gitcommand, repo_path, (char *)NULL);
197 44e35bfc 2023-04-01 thomas 		error = got_error_from_errno2("execl", gitcommand);
198 5dcb3a43 2023-04-01 thomas 	}
199 5dcb3a43 2023-04-01 thomas 
200 5dcb3a43 2023-04-01 thomas done:
201 5dcb3a43 2023-04-01 thomas 	free(command);
202 5dcb3a43 2023-04-01 thomas 	free(repo_name);
203 5dcb3a43 2023-04-01 thomas 	free(myserver);
204 5dcb3a43 2023-04-01 thomas 	free(gitcommand);
205 5dcb3a43 2023-04-01 thomas 	if (error) {
206 5dcb3a43 2023-04-01 thomas 		fprintf(stderr, "%s: %s\n", getprogname(), error->msg);
207 5dcb3a43 2023-04-01 thomas 		return 1;
208 5dcb3a43 2023-04-01 thomas 	}
209 5dcb3a43 2023-04-01 thomas 
210 5dcb3a43 2023-04-01 thomas 	return 0;
211 5dcb3a43 2023-04-01 thomas }