blob: 74801aac9329b62835b1b721b065b3956550275a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
#!/bin/bash
set -e -o pipefail
declare -a shared_paths
require_extension=.fossil
IFS=/ read n pid uid <<< "$1"
[ "$pid" ]
[ "$uid" -gt 0 ]
IFS=: read username realname uid_ gid gecos homedir shell < <(getent passwd "$uid")
[ "$uid" = "$uid_" ]
shared_paths=("$homedir"/./src /srv/./src /usr/./src /usr/local/./src)
authtype=
while read -d ''
do
case "${REPLY%%=*}" in
'SSH_USER_AUTH' ) read authtype keytype keyvalue < "${REPLY#*=}" ;;
'SSH_ORIGINAL_COMMAND' ) SSH_ORIGINAL_COMMAND=${REPLY#*=} ;;
esac
done < /proc/$pid/environ
[ "$authtype" = publickey ]
case "$SSH_ORIGINAL_COMMAND" in
*\"* ) exit 1 ;;
: | true | /bin/true ) exit 0 ;;
fossil\ test-http\ */../* ) exit 1 ;;
fossil\ test-http\ ../* ) exit 1 ;;
fossil\ test-http\ */.. ) exit 1 ;;
fossil\ test-http\ * )
set -- $SSH_ORIGINAL_COMMAND
[ $# = 3 ]
for d in "${shared_paths[@]}"
do
f=${3#${d##*/./}/} # remove prefix "src/" from input if present
f=${f%$require_extension}$require_extension # add suffix ".fossil" if not present
[ "$f" != "$require_extension" ] # basename is not ""
if upstreamDatabase=$(realpath -e -s "$d"/"$f")
then
break
fi
done
[ "$upstreamDatabase" ]
;;
* ) exit 1 ;;
esac
keyhash=
while read
do
set -- $REPLY
if [ "$3 $5" = 'SSHFP 2' ]
then
keyhash=$6
break
fi
done < <(ssh-keygen -f <(printf '%s\n' "$keytype $keyvalue") -r .)
[ "$keyhash" ]
upstreamDatabaseDir=${upstreamDatabase%/*}
readWriteDbName=${upstreamDatabase#${upstreamDatabaseDir}/}
as_user()
{
setpriv --reuid="$uid" --regid="$gid" --clear-groups --inh-caps=-all "$@"
}
setup_fossil_remotes()
{
if ! [ -d "$readWriteDir" ]
then
make_parents=
if [[ $readWriteDir == $home/* ]]
then
[ -d "$upstreamDatabaseDir" ]
make_parents=-p
fi
as_user mkdir $make_parents "$readWriteDir"
fi
as_user cp -n --reflink -- "$upstreamDatabase" "$readWriteDir"/"$readWriteDbName"
}
case "$upstreamDatabaseDir" in
*/"$keyhash" ) readWriteDir=$upstreamDatabaseDir ;;
* )
readWriteDir=$upstreamDatabaseDir/.fossil-remotes/$keyhash
setup_fossil_remotes
;;
esac
exec systemd-run -P \
--property=User="$username" \
--property=ReadOnlyPaths=/ \
--property=ReadWritePaths="$readWriteDir" \
--property=WorkingDirectory="$readWriteDir" \
-- fossil test-http "$readWriteDbName"
|
