Re: [PATCH] daemon: return "access denied" if a service is not allowed
From: Jeff King <hidden>
Date: 2016-06-15 22:52:14
Subsystem:
the rest · Maintainer:
Linus Torvalds
Possibly related (same subject, not in this thread)
- 2016-06-15 · Re: [PATCH] daemon: return "access denied" if a service is not allowed · Junio C Hamano <hidden>
- 2016-06-15 · Re: [PATCH] daemon: return "access denied" if a service is not allowed · Jeff King <hidden>
- 2016-06-15 · Re: [PATCH] daemon: return "access denied" if a service is not allowed · Jeff King <hidden>
- 2016-06-15 · Re: [PATCH] daemon: return "access denied" if a service is not allowed · Jeff King <hidden>
- 2016-06-15 · Re: [PATCH] daemon: return "access denied" if a service is not allowed · Junio C Hamano <hidden>
On Tue, Oct 04, 2011 at 08:55:09AM +1100, Nguyen Thai Ngoc Duy wrote:
The message is chosen to avoid leaking information, yet let users know that they are deliberately not allowed to use the service, not a fault in service configuration or the service itself.
I do think this is an improvement, but I wonder if the verbosity should be configurable. Then open sites like kernel.org could be friendlier to their users. Something like this instead: --- daemon.c | 21 +++++++++++++++++---- 1 files changed, 17 insertions(+), 4 deletions(-)
diff --git a/daemon.c b/daemon.c
index 4c8346d..ec88fd0 100644
--- a/daemon.c
+++ b/daemon.c@@ -20,6 +20,7 @@ static int log_syslog; static int verbose; static int reuseaddr; +static int informative_errors; static const char daemon_usage[] = "git daemon [--verbose] [--syslog] [--export-all]\n"
@@ -247,6 +248,14 @@ static int git_daemon_config(const char *var, const char *value, void *cb) return 0; } +static int daemon_error(const char *dir, const char *msg) +{ + if (!informative_errors) + msg = "access denied"; + packet_write(1, "ERR %s: %s", dir, msg); + return -1; +} + static int run_service(char *dir, struct daemon_service *service) { const char *path;
@@ -257,11 +266,11 @@ static int run_service(char *dir, struct daemon_service *service) if (!enabled && !service->overridable) { logerror("'%s': service not enabled.", service->name); errno = EACCES; - return -1; + return daemon_error(dir, "service not enabled"); } if (!(path = path_ok(dir))) - return -1; + return daemon_error(dir, "no such repository"); /* * Security on the cheap.
@@ -277,7 +286,7 @@ static int run_service(char *dir, struct daemon_service *service) if (!export_all_trees && access("git-daemon-export-ok", F_OK)) { logerror("'%s': repository not exported.", path); errno = EACCES; - return -1; + return daemon_error(dir, "repository not exported"); } if (service->overridable) {
@@ -291,7 +300,7 @@ static int run_service(char *dir, struct daemon_service *service) logerror("'%s': service not enabled for '%s'", service->name, path); errno = EACCES; - return -1; + return daemon_error(dir, "service not enabled"); } /*
@@ -1167,6 +1176,10 @@ int main(int argc, char **argv) make_service_overridable(arg + 18, 0); continue; } + if (!prefixcmp(arg, "--informative-errors")) { + informative_errors = 1; + continue; + } if (!strcmp(arg, "--")) { ok_paths = &argv[i+1]; break;
--
1.7.7.rc2.21.gb9948