Commits
- Commit:
c7224e4126f5079e0dcb5b29b8ddb14c242a6c0b
- From:
- Omar Polo <op@omarpolo.com>
- Date:
gotd: delete unreachable code after gotd_shutdown()
- Commit:
77f619a8442c52e9c02e8060b76c25def0b5f1c6
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
revoke filesystem access in gotd listen process via unveil(2)
This should avoid involuntary use of bind(2) with arbitrary socket paths.
ok op@
- Commit:
7843333165edf3bdaa739cd96c701e1b7d53aa81
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
expose 'gotctl info' output only to the root user
Now that anyone can connect to the socket, it is probably safer to
expose information about currently connected clients only to root.
- Commit:
6f854dde056f82d0c757c720beed863fc557a1ca
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
remove the gotsh group requirement from gotd; any user can now connect
Repository access is now controlled by access rules in gotd.conf,
and concurrent connections to the gotd socket by local users are
limited by the listen process. We should keep refining our anti-DoS
measures in the future, but at least we have something in place now.
ok jamsek, op
- Commit:
40b85cca5d86ebef3a353efd464af989c3ebf18b
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
introduce connection options to gotd.conf
Allow administrators to tweak the default authentication and request
timeouts if needed, and to tweak the limit of concurrent connections
for specific user accounts.
with several tweaks from and ok op@
- Commit:
77d0cae1993d80e742dbcf69ace80700ed616831
- From:
- Omar Polo <op@omarpolo.com>
- Date:
fmt
- Commit:
7fdc3e586448ae55ae38bef76bb5a0a34538e5e6
- From:
- Mark Jamsek <mark@jamsek.dev>
- Date:
gotd: nix trailing whitespace and indentation fix
ok op@, stsp@
- Commit:
44587340e4924f8f07bf02c57a9a1c2527c2d8d4
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
remove filesystem access via bind(2) from gotd auth process
op@ pointed out a problem in my initial patch where I forgot
to call unveil(2) with a path before unveil(NULL, NULL).
ok op, jamsek
- Commit:
365cf0f34d08316d433e730a8663283029f729b3
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
move "unix" pledge promise from gotd parent to auth process
The listen process now communicates the client UID/GID to the parent,
and the auth process verifies this on behalf of the parent.
This allows us to remove the "unix" pledge promise from the parent,
removing parent access to syscalls such as listen() and accept() in
the AF_UNIX domain.
ok tracey@ op@
- Commit:
ef4e2f01b0bff14f003a72321ce0165a0df72fa1
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
fix gotd authentication timeout
The authentication timeout was accidentally overriden by the request timeout.
Fix this and set both timeouts in the same place for clarity.
ok op@
- Commit:
5e25db14db9eb20ee11b68048b45b3e0f54d50eb
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
run gotd authentication in a separate child process
ok op@
- Commit:
b50a2b4639132c68255480f1c5c8785fd7cd8094
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
fork gotd repo_read/repo_write children on demand
ok op, jamsek
- Commit:
898c8f8fd003d730d0490c1a5a807e4c11e30f4b
- From:
- Omar Polo <op@omarpolo.com>
- Date:
gotd: tweak error message if getpwnam fails
errno may not be set to something interesting so switch to fatalx, and
simplify the error message (knowing the failed function, which is also
wrong, doesn't buy much here.)
ok jamsek
- Commit:
eec68231a79adb345b1a6a3194e5ddb353570356
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
switch gotd from chroot(2) to unveil(2)
In the future, gotd will fork+exec new processes for each client connection.
Using unveil instead of chroot avoids having to start such processes as root.
The -portable version could use chroot(2) where no equivalent to unveil(2)
exists. A future component which starts new processes will be isolated as
a separate process, which could run as root in the -portable version.
ok op@
- Commit:
d93ecf7dc6dd75bc506128cc5666c1b76761e0a0
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add a gotd "listen" process which watches the unix socket
ok op@
- Commit:
b1142068fd26fa24285c533f10e3afcb61719759
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
fix gotd startup without any -v options
- Commit:
8c6fc1468a57de4851e137b55bda5cd838e2f759
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
rename GOTD_SOCK_FILENO to GOTD_FILENO_MSG_PIPE for clarity (it's not a socket)
- Commit:
a45aafaf9bf7910fed713ff35d6d051d463bae98
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
tedu Ted's copyright added to gotd.c by accident; doas-derived code is in auth.c
- Commit:
ddbe612c691511246aacb15046c1a202d0efcf75
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
fix group membership check in gotd auth
ok op@
- Commit:
0ccf3acb6c3004ac41b46ad931024da1f4ea0e3e
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
implement per-repository read/write authorization rules in gotd
ok op@
- Commit:
86b188ee113cde1b53e1d3544b40ce80ab7767a7
- From:
- Josiah Frentsos <jfrent@tilde.team>
- Via:
- Omar Polo <op@omarpolo.com>
- Date:
gotd: Don't include stdlib.h twice
- Commit:
36c7cfbb2a9b646bfb1658fca4e34bc63a46ec42
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
fix crash in gotd if client gets disconnected on error; reported by Mikhail
- Commit:
b90054ed55f30ebe28115abf5ad9cecc2b925713
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
use mkstemps(3) instead of mkstemp(3) for opening named temporary files
Allows 'got commit' to use a ".diff" suffix for temporary diff files.
ok op@
- Commit:
585362fdeffda23f6ace02652caf7c5b0ecd4759
- From:
- Omar Polo <op@omarpolo.com>
- Date:
gotd: propagate confpath to children as well
otherwise they end up running with default config which isn't ideal.
ok stsp@
- Commit:
f1752522ac2fd00af85111c530b80ef1187a07f7
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add gotctl(8); initially supported commands are 'info' and 'stop'
This will be used by an upcoming regress test suite for gotd(8).
ok tracey