@matheusbsbs / matheus-bagliano / commits / dee8a1455c

daemon: clarify directory arguments

The undecorated arguments to the 'git-daemon' command provide a list of directories. When at least one directory is specified, then 'git-daemon' only serves requests that are within that directory list. The boolean '--strict-paths' option makes the list more explicit in that subdirectories are no longer included. The existing documentation and error messages around this directory list refer to it and its behavior as a "whitelist". The word "whitelist" has cultural implications that are not inclusive. Thankfully, it is not difficult to reword and avoid its use. In the process, we can define the purpose of this directory list directly. In Documentation/git-daemon.txt, rewrite the OPTIONS section around the '<directory>' option. Add additional clarity to the other options that refer to these directories. Some error messages can also be improved in daemon.c. The '--strict-paths' option requires '<directory>' arguments, so refer to that section of the documentation directly. A logerror() call points out that a requested directory is not in the specified directory list. We can use "list" here without any loss of information. Signed-off-by: Derrick Stolee <derrickstolee@github.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Derrick Stolee committed Jul 19, 2022 at 18:32 UTC dee8a1455c8ad443ef59e0d5b7c168886e50b9ea

2 files changed +15 -14

Documentation/git-daemon.txt

+11 -10

@@ -32,8 +32,8 @@ that service if it is enabled.

32 It verifies that the directory has the magic file "git-daemon-export-ok", and

33 it will refuse to export any Git directory that hasn't explicitly been marked

34 for export this way (unless the `--export-all` parameter is specified). If you

35 -pass some directory paths as 'git daemon' arguments, you can further restrict

36 -the offers to a whitelist comprising of those.

35 +pass some directory paths as 'git daemon' arguments, the offers are limited to

36 +repositories within those directories.

38 By default, only `upload-pack` service is enabled, which serves

39 'git fetch-pack' and 'git ls-remote' clients, which are invoked

@@ -50,7 +50,7 @@ OPTIONS

50 Match paths exactly (i.e. don't allow "/foo/repo" when the real path is

51 "/foo/repo.git" or "/foo/repo/.git") and don't do user-relative paths.

52 'git daemon' will refuse to start when this option is enabled and no

53 - whitelist is specified.

53 + directory arguments are provided.

55 --base-path=<path>::

56 Remap all the path requests as relative to the given path.

@@ -73,7 +73,7 @@ OPTIONS

73 %IP for the server's IP address, %P for the port number,

74 and %D for the absolute path of the named repository.

75 After interpolation, the path is validated against the directory

76 - whitelist.

76 + list.

78 --export-all::

79 Allow pulling from all directories that look like Git repositories

@@ -218,9 +218,11 @@ standard output to be sent to the requestor as an error message when

218 it declines the service.

219

220 <directory>::

221 - A directory to add to the whitelist of allowed directories. Unless

222 - --strict-paths is specified this will also include subdirectories

223 - of each named directory.

221 + The remaining arguments provide a list of directories. If any

222 + directories are specified, then the `git-daemon` process will

223 + serve a requested directory only if it is contained in one of

224 + these directories. If `--strict-paths` is specified, then the

225 + requested directory must match one of these directories exactly.

226

227 SERVICES

228 --------

@@ -264,9 +266,8 @@ git 9418/tcp # Git Version Control System

266

267 'git daemon' as inetd server::

268 To set up 'git daemon' as an inetd service that handles any

267 - repository under the whitelisted set of directories, /pub/foo

268 - and /pub/bar, place an entry like the following into

269 - /etc/inetd all on one line:

269 + repository within `/pub/foo` or `/pub/bar`, place an entry like

270 + the following into `/etc/inetd` all on one line:

271 +

272 ------------------------------------------------

273 git stream tcp nowait nobody /usr/bin/git

daemon.c

+4 -4

@@ -279,7 +279,7 @@ static const char *path_ok(const char *directory, struct hostinfo *hi)

279 /* The validation is done on the paths after enter_repo

280 * appends optional {.git,.git/.git} and friends, but

281 * it does not use getcwd(). So if your /pub is

282 - * a symlink to /mnt/pub, you can whitelist /pub and

282 + * a symlink to /mnt/pub, you can include /pub and

283 * do not have to say /mnt/pub.

284 * Do not say /pub/.

285 */

@@ -298,7 +298,7 @@ static const char *path_ok(const char *directory, struct hostinfo *hi)

298 return path;

299 }

300

301 - logerror("'%s': not in whitelist", path);

301 + logerror("'%s': not in directory list", path);

302 return NULL; /* Fallthrough. Deny by default */

303 }

304

@@ -403,7 +403,7 @@ static int run_service(const char *dir, struct daemon_service *service,

403 * a "git-daemon-export-ok" flag that says that the other side

404 * is ok with us doing this.

405 *

406 - * path_ok() uses enter_repo() and does whitelist checking.

406 + * path_ok() uses enter_repo() and checks for included directories.

407 * We only need to make sure the repository is exported.

408 */

409

@@ -1444,7 +1444,7 @@ int cmd_main(int argc, const char **argv)

1444 cred = prepare_credentials(user_name, group_name);

1445

1446 if (strict_paths && (!ok_paths || !*ok_paths))

1447 - die("option --strict-paths requires a whitelist");

1447 + die("option --strict-paths requires '<directory>' arguments");

1448

1449 if (base_path && !is_directory(base_path))

1450 die("base-path '%s' does not exist or is not a directory",