Git-daemon messing up permissions for gitweb

Git-daemon messing up permissions for gitweb

[Post, Mark K]

I'm trying to set up a git repository for mainframe Linux developers to
use at git390.osdl.marist.edu.  Everything _seemed_ to go well, until
Martin Schwidefsky started actually pushing changes back to the
repository.  When he does that, the projects disappear from the web page
that gitweb.cgi is generating.

As far as I can tell, the problem is happening because these files are
being written out with file permissions of 640, and since Apache is
running as user wwwrun, it can't read them:
-rw-r-----  1 sky git  5490 Jun  9 03:35 ./linux-2.6.git/info/refs
-rw-r-----  1 sky git    54 Jun  9 03:35
./linux-2.6.git/objects/info/packs
-rw-r-----  1 sky git    41 Jun  9 03:35
./linux-2.6.git/refs/heads/master
-rw-r-----  1 sky git    41 Jun  9 03:35
./linux-2.6.git/refs/heads/origin
-rw-r-----  1 sky git  5490 Jun  9 04:00
./s390-experimental.git/info/refs
-rw-r-----  1 sky git     1 Jun  9 04:00
./s390-experimental.git/objects/info/packs
-rw-r-----  1 sky git    41 Jun  9 04:00
./s390-experimental.git/refs/heads/master
-rw-r-----  1 sky git  5490 Jun  9 11:31 ./s390-features.git/info/refs
-rw-r-----  1 sky git     1 Jun  9 11:31
./s390-features.git/objects/info/packs
-rw-r-----  1 sky git    41 Jun  9 11:31
./s390-features.git/refs/heads/master
-rw-r-----  1 sky git  5490 Jun  9 03:41 ./s390-fixes.git/info/refs
-rw-r-----  1 sky git     1 Jun  9 03:41
./s390-fixes.git/objects/info/packs
-rw-r-----  1 sky git    41 Jun  9 03:41
./s390-fixes.git/refs/heads/master

I know I could brute-force this by adding wwwrun to the git group, but I
first wanted to find out if that is the solution, or if something is
wrong with the way I've set things up.  I tried searching the mailing
list archives, but nothing that appeared to be relevant turned up.

Thanks in advance for any help,

Mark Post

Re: Git-daemon messing up permissions for gitweb

[Jakub Narebski]

Post, Mark K wrote:

> I'm trying to set up a git repository for mainframe Linux developers to
> use at git390.osdl.marist.edu.  Everything _seemed_ to go well, until
> Martin Schwidefsky started actually pushing changes back to the
> repository.  When he does that, the projects disappear from the web page
> that gitweb.cgi is generating.
> 
> As far as I can tell, the problem is happening because these files are
> being written out with file permissions of 640, and since Apache is
> running as user wwwrun, it can't read them:
> -rw-r-----  1 sky git  5490 Jun  9 03:35 ./linux-2.6.git/info/refs

One of the possible soultion would be to add sky to Apache group,
make directory sticky-group, and make files readable by group (perhaps by
marking repository as shared, or something).

-- 
Jakub Narebski
Warsaw, Poland

Re: Git-daemon messing up permissions for gitweb

[Linus Torvalds]

On Fri, 9 Jun 2006, Post, Mark K wrote:
>
> As far as I can tell, the problem is happening because these files are
> being written out with file permissions of 640, and since Apache is
> running as user wwwrun, it can't read them:

You can either make sure that people have something like

	umask 0022

in their bashrc (or that it's the default umask), so that they do things 
world-readably by default.

Or add
	[core]
		SharedRepository = true

to the repository config file.

		Linus

RE: Git-daemon messing up permissions for gitweb

[Post, Mark K]

I just triple-checked, and both those things are already in place.  The
default umask is 0022, and all the config files have:
[core]
        repositoryformatversion = 0
        filemode = true
        sharedrepository = true

I see that the case of the value is different from what you typed:
SharedRepository 
Is that significant (as almost everything is)?


Mark Post

-----Original Message-----
From: Linus Torvalds [mailto:torvalds@osdl.org] 
Sent: Friday, June 09, 2006 3:06 PM
To: Post, Mark K
Cc: git@vger.kernel.org
Subject: Re: Git-daemon messing up permissions for gitweb



On Fri, 9 Jun 2006, Post, Mark K wrote:
>
> As far as I can tell, the problem is happening because these files are
> being written out with file permissions of 640, and since Apache is
> running as user wwwrun, it can't read them:

You can either make sure that people have something like

	umask 0022

in their bashrc (or that it's the default umask), so that they do things

world-readably by default.

Or add
	[core]
		SharedRepository = true

to the repository config file.

		Linus

RE: Git-daemon messing up permissions for gitweb

[Jakub Narebski]

Post, Mark K wrote:

> [core]
>         repositoryformatversion = 0
>         filemode = true
>         sharedrepository = true
> 
> I see that the case of the value is different from what you typed:
>         SharedRepository = true
> Is that significant (as almost everything is)?

No, the keys are case-insensitive.

-- 
Jakub Narebski
Warsaw, Poland

Re: Git-daemon messing up permissions for gitweb

[Junio C Hamano]

"Post, Mark K" <mark.post@eds.com> writes:

> I'm trying to set up a git repository for mainframe Linux developers to
> use at git390.osdl.marist.edu.  Everything _seemed_ to go well, until
> Martin Schwidefsky started actually pushing changes back to the
> repository.  When he does that, the projects disappear from the web page
> that gitweb.cgi is generating.

> As far as I can tell, the problem is happening because these files are
> being written out with file permissions of 640, and since Apache is
> running as user wwwrun, it can't read them:
> -rw-r-----  1 sky git  5490 Jun  9 03:35 ./linux-2.6.git/info/refs
> -rw-r-----  1 sky git    54 Jun  9 03:35
> ./linux-2.6.git/objects/info/packs
> -rw-r-----  1 sky git    41 Jun  9 03:35

First of all, it is not git-daemon that is updating these refs.
The daemon is a read only facility.

And you have checked the suggestion by Linus to set the umask to
world readable, which brings me to the next question.  

How did Martin actually "push changes back"?

Was it over git protocol over SSH, or the webdav thing over http
push?  The comment by Linus is about the former and I do not
know offhand who webdav thing runs as or how it handles the
permissino bits.

It could be that your ssh daemon installation bypasses .bashrc
and uses its own .ssh/environment, in which case your user would
may need to do umask there as well.

Re: Git-daemon messing up permissions for gitweb

[Junio C Hamano]

Linus Torvalds <torvalds@osdl.org> writes:

> On Fri, 9 Jun 2006, Post, Mark K wrote:
>>
>> As far as I can tell, the problem is happening because these files are
>> being written out with file permissions of 640, and since Apache is
>> running as user wwwrun, it can't read them:

> Or add
> 	[core]
> 		SharedRepository = true
>
> to the repository config file.

This is about being able to share among the group, not with
people outside, so if wwwrun is outside git group like Mark's
setting I do not think it would do anything helpful to the
situation.

RE: Git-daemon messing up permissions for gitweb

[Post, Mark K]

Martin is using git over SSH.  I have git-shell in /etc/passwd for his
account.

Mark Post 

-----Original Message-----
From: Junio C Hamano [mailto:junkio@cox.net] 
Sent: Friday, June 09, 2006 3:51 PM
To: Post, Mark K
Cc: git@vger.kernel.org
Subject: Re: Git-daemon messing up permissions for gitweb

"Post, Mark K" <mark.post@eds.com> writes:

> I'm trying to set up a git repository for mainframe Linux developers
to
> use at git390.osdl.marist.edu.  Everything _seemed_ to go well, until
> Martin Schwidefsky started actually pushing changes back to the
> repository.  When he does that, the projects disappear from the web
page
> that gitweb.cgi is generating.

> As far as I can tell, the problem is happening because these files are
> being written out with file permissions of 640, and since Apache is
> running as user wwwrun, it can't read them:
> -rw-r-----  1 sky git  5490 Jun  9 03:35 ./linux-2.6.git/info/refs
> -rw-r-----  1 sky git    54 Jun  9 03:35
> ./linux-2.6.git/objects/info/packs
> -rw-r-----  1 sky git    41 Jun  9 03:35

First of all, it is not git-daemon that is updating these refs.
The daemon is a read only facility.

And you have checked the suggestion by Linus to set the umask to
world readable, which brings me to the next question.  

How did Martin actually "push changes back"?

Was it over git protocol over SSH, or the webdav thing over http
push?  The comment by Linus is about the former and I do not
know offhand who webdav thing runs as or how it handles the
permissino bits.

It could be that your ssh daemon installation bypasses .bashrc
and uses its own .ssh/environment, in which case your user would
may need to do umask there as well.

Re: Git-daemon messing up permissions for gitweb

[Junio C Hamano]

"Post, Mark K" <mark.post@eds.com> writes:

> Martin is using git over SSH.  I have git-shell in /etc/passwd for his
> account.

Ah, then umask git-shell gets from sshd is too restrictive.
Loosen it and you will be fine.

RE: Git-daemon messing up permissions for gitweb

[Linus Torvalds]

On Fri, 9 Jun 2006, Post, Mark K wrote:
>
> Martin is using git over SSH.  I have git-shell in /etc/passwd for his
> account.

Ahh. git-shell doesn't read .bashrc or anything like that.

Does adding a "umask(0022)" to the beginning of main() in shell.c fix it 
for you?

		Linus

RE: Git-daemon messing up permissions for gitweb

[Post, Mark K]

I'm not a C programmer, so I'm not sure exactly how to do what you want.
Is this right (it compiles)?
--- shell.c.orig        2006-05-15 16:01:37.000000000 -0400
+++ shell.c     2006-06-09 16:26:24.619808905 -0400
@@ -31,7 +31,7 @@
 {
        char *prog;
        struct commands *cmd;
-
+       umask(0022);
        /* We want to see "-c cmd args", and nothing else */
        if (argc != 3 || strcmp(argv[1], "-c"))
                die("What do you think I am? A shell?"); 

I won't be able to report success or failure today.  Martin's in Germany
and I think he has a life.


Mark Post

-----Original Message-----
From: Linus Torvalds [mailto:torvalds@osdl.org] 
Sent: Friday, June 09, 2006 4:22 PM
To: Post, Mark K
Cc: Junio C Hamano; git@vger.kernel.org
Subject: RE: Git-daemon messing up permissions for gitweb



On Fri, 9 Jun 2006, Post, Mark K wrote:
>
> Martin is using git over SSH.  I have git-shell in /etc/passwd for his
> account.

Ahh. git-shell doesn't read .bashrc or anything like that.

Does adding a "umask(0022)" to the beginning of main() in shell.c fix it

for you?

		Linus

Re: Git-daemon messing up permissions for gitweb

[Junio C Hamano]

Linus Torvalds <torvalds@osdl.org> writes:

> On Fri, 9 Jun 2006, Post, Mark K wrote:
>>
>> Martin is using git over SSH.  I have git-shell in /etc/passwd for his
>> account.
>
> Ahh. git-shell doesn't read .bashrc or anything like that.

But that should be tweakable by configuring what sshd does for
the user, shouldn't it?  The "LOGIN PROCESS" section from man
sshd(8) seems to talk about $HOME/.ssh/environment, for example.

Re: Git-daemon messing up permissions for gitweb

[Linus Torvalds]

On Fri, 9 Jun 2006, Junio C Hamano wrote:
>
> But that should be tweakable by configuring what sshd does for
> the user, shouldn't it?  The "LOGIN PROCESS" section from man
> sshd(8) seems to talk about $HOME/.ssh/environment, for example.

Yeah. That's probably the right place to set things up.

		Linus

RE: Git-daemon messing up permissions for gitweb

[Post, Mark K]

I'm fairly familiar with SSH, but I don't know how to do this.  I just
did some man commands, didn't see anything there.  Can you give me a
pointer?


Mark Post 

-----Original Message-----
From: Junio C Hamano [mailto:junkio@cox.net] 
Sent: Friday, June 09, 2006 4:19 PM
To: Post, Mark K
Cc: git@vger.kernel.org
Subject: Re: Git-daemon messing up permissions for gitweb

"Post, Mark K" <mark.post@eds.com> writes:

> Martin is using git over SSH.  I have git-shell in /etc/passwd for his
> account.

Ah, then umask git-shell gets from sshd is too restrictive.
Loosen it and you will be fine.

RE: Git-daemon messing up permissions for gitweb

[Post, Mark K]

Since umask isn't an environment variable, per se, I'm not sure how this
will change anything.

One other thing I noticed is that init-db.c spells core.sharedRepository
with a capital R, but setup.c spells it "core.sharedrepository" with no
upper case letters.  Would this make any difference to anything I'm
seeing? 


Mark Post

-----Original Message-----
From: Linus Torvalds [mailto:torvalds@osdl.org] 
Sent: Friday, June 09, 2006 4:44 PM
To: Junio C Hamano
Cc: git@vger.kernel.org; Post, Mark K
Subject: Re: Git-daemon messing up permissions for gitweb



On Fri, 9 Jun 2006, Junio C Hamano wrote:
>
> But that should be tweakable by configuring what sshd does for
> the user, shouldn't it?  The "LOGIN PROCESS" section from man
> sshd(8) seems to talk about $HOME/.ssh/environment, for example.

Yeah. That's probably the right place to set things up.

		Linus

Re: Git-daemon messing up permissions for gitweb

[Jakub Narebski]

I've put proposed solution in GitWiki:

  http://git.or.cz/gitwiki/GitFaq#git-push-ssh-umask

-- 
Jakub Narebski
Warsaw, Poland

Re: Git-daemon messing up permissions for gitweb

[Junio C Hamano]

"Post, Mark K" <mark.post@eds.com> writes:

> Since umask isn't an environment variable, per se, I'm not sure how this
> will change anything.

I do not configure my sshd, so you may need a bit more reading
on it yourself; $HOME/.ssh/environment does not seem to be it,
as you said.

> One other thing I noticed is that init-db.c spells core.sharedRepository
> with a capital R, but setup.c spells it "core.sharedrepository" with no
> upper case letters.  Would this make any difference to anything I'm
> seeing? 

The distinction should not matter since the code downcases
(git_config_set_multivar() in config.c) it, but to avoid future
confusion we might want to downcase the one in init-db.c

Re: Git-daemon messing up permissions for gitweb

[Alex Riesen]

Post, Mark K, Fri, Jun 09, 2006 22:52:22 +0200:
> Since umask isn't an environment variable, per se, I'm not sure how this
> will change anything.

$ ssh -V
OpenSSH_4.2p1, OpenSSL 0.9.7i 14 Oct 2005

$ man sshd
     ~/.ssh/rc
             If this file exists, it is run with /bin/sh after reading the
             environment files but before starting the user's shell or com-
             mand.  It must not produce any output on stdout; stderr must be
             used instead.  If X11 forwarding is in use, it will receive the
             "proto cookie" pair in its standard input (and DISPLAY in its
             environment).  The script must call xauth(1) because sshd will
             not run xauth automatically to add X11 cookies.

AFAIK, it was always there.

Re: Git-daemon messing up permissions for gitweb

[Linus Torvalds]

On Sat, 10 Jun 2006, Alex Riesen wrote:
>
>      ~/.ssh/rc
> 
> AFAIK, it was always there.

Note that since umask is a per-process flag, and only inherited from 
parents to children, not the other way around, if the rc file is run as a 
separate shell script (and I assume it is) instead of "sourced" from the 
the shell that actually executes the programs you run, then this won't 
help at all.

Try:

	sh -c "umask 0777 ; umask" ; umask

to see in more graphic ("textual") detail what I mean.

		Linus

Re: Git-daemon messing up permissions for gitweb

[Alex Riesen]

Linus Torvalds, Sat, Jun 10, 2006 23:41:52 +0200:
> >
> >      ~/.ssh/rc
> > 
> > AFAIK, it was always there.
> 
> Note that since umask is a per-process flag, and only inherited from 
> parents to children, not the other way around, if the rc file is run as a 
> separate shell script (and I assume it is) instead of "sourced" from the 
> the shell that actually executes the programs you run, then this won't 
> help at all.

Right, it doesn't. I should have tried ~/.ssh/rc with umask, really.
Because of this it can't be used for environment too (that's why they
have ~/.ssh/environment).