daemon: return "access denied" if a service is not allowed
The message is chosen to avoid leaking information, yet let users know that they are deliberately not allowed to use the service, not a fault in service configuration or the service itself. Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Nguyễn Thái Ngọc Duy committed
Oct 4, 2011 at 08:55 UTC
723f7a1387f1d79541fdbe66ad3778f2aaa370c4
1 file changed
+8
-4
daemon.c
+8
-4
@@ -257,11 +257,11 @@ static int run_service(char *dir, struct daemon_service *service)
257
if (!enabled && !service->overridable) {
258
logerror("'%s': service not enabled.", service->name);
259
errno = EACCES;
260
- return -1;
260
+ goto failed;
261
}
262
263
if (!(path = path_ok(dir)))
264
- return -1;
264
+ goto failed;
265
266
/*
267
* Security on the cheap.
@@ -277,7 +277,7 @@ static int run_service(char *dir, struct daemon_service *service)
277
if (!export_all_trees && access("git-daemon-export-ok", F_OK)) {
278
logerror("'%s': repository not exported.", path);
279
errno = EACCES;
280
- return -1;
280
+ goto failed;
281
}
282
283
if (service->overridable) {
@@ -291,7 +291,7 @@ static int run_service(char *dir, struct daemon_service *service)
291
logerror("'%s': service not enabled for '%s'",
292
service->name, path);
293
errno = EACCES;
294
- return -1;
294
+ goto failed;
295
}
296
297
/*
@@ -301,6 +301,10 @@ static int run_service(char *dir, struct daemon_service *service)
301
signal(SIGTERM, SIG_IGN);
302
303
return service->fn();
304
+
305
+failed:
306
+ packet_write(1, "ERR %s: access denied", dir);
307
+ return -1;
308
}
309
310
static void copy_to_log(int fd)