git-daemon/chiark-urlmap: better security

[userv-utils] / git-daemon / git-service

#!/usr/bin/perl
#
# userv-git-daemon service script
#
# This was written by Tony Finch <dot@dotat.at>
# You may do anything with it, at your own risk.
# http://creativecommons.org/publicdomain/zero/1.0/

use strict;
use warnings;

use Sys::Syslog;

${$::{$_}} = $ENV{"USERV_U_$_"}
       for grep s|^USERV_U_([a-z_]+)$|$1|, keys %ENV;

our ($client,$service,$path,$host,@opts);

openlog "userv-$service", 'pid', 'daemon';
sub fail { syslog 'err', "$client @_"; exit }

our ($check_repo,$check_export,$dir,$repo) = (1,0);
our $uri = $_ = "git://$host/$path";
for my $cf (@ARGV) { do $cf }

my $home = (getpwuid $<)[7];
$dir = "$home/$dir" if $dir =~ m|^[^/]|
                    or $dir =~ s|^~/||;
fail "Bad filename $repo" if $check_repo
               and $repo !~ m|^\w[\w.=+-]*\.git$|;
$dir = "$dir/$repo" if defined $repo;
$path = $check_export ? "$dir/git-daemon-export-ok" : $dir;
fail "$! $path" unless -e $path;
syslog 'notice', "$client $dir";

@opts = qw( --strict --timeout-30 )
   if @opts == 0 and $service eq 'git-upload-pack';

my @cmd = ($service =~ m|^(git)-(.*)$|, @opts, $dir);
no warnings; # suppress errors to stderr
exec @cmd or fail "exec $service: $!";

# end