Subject: Re: [RFC] daemon whitelist handling (Re: git pull aborts in 50% of cases)

From: "H. Peter Anvin" <[email-masked]>
Date: Sat, 03 Dec 2005 12:45:42 -0800

Junio C Hamano wrote:
> "H. Peter Anvin" <[email-masked]> writes:
> 
>>At the very least, if you insist on using getcwd() names, you should 
>>pre-canonicalize the whitelist, too.
> 
> With the current "prefix" rule (and not allowing /ho to match
> /home) that sounds possible and sensivle, but that is not nice
> in the long run.  We may later want to say "/pub/git/**/*.git"
> for example to mean "any subdirectory under /pub/git but the
> base directory name must be something ending with '.git'".
> 
> Hmm...
> 

Yep, this stuff is hard.  For example, on kernel.org I'm not concerned 
about symbolic links; the likelihood of an accidental symbolic link that 
would violate security is very small.  Other applications might be 
different.

Arguably, the correct interface is to modularize it, and have both the 
user request, the post-DWIM output, and the

	-hpa