1

In my server I host some git repositories via gitolite, and have a trac for every repository.

I have a user called git to push/pull from server (git clone git@server:repo). and trac is a apache vhost with mod_wsgi. this runs with the www-data user.

So what riddles me (maybe because I have not much of a clue about file-permissions at all) is what's the best permissions setup (chown, chmod) for the git repositories (/home/git/repositories/...).

www-data (or trac) needs to at least read permissions (i think). and git (or gitolite) needs obviously read/write permissions to push changesets.

I tried a little bit around (i.e. adding www-data and/or git to the www-data/git group), but didn't got it right. at least one of the two don't work (git or trac).

any suggestions are highly appreciated.

hjpotter92
  • 660
  • 1
  • 10
  • 20
fetzig
  • 251
  • 1
  • 6

2 Answers2

2

The most secure way of doing it I would say is to have a group called git-readers

add git and www-data to it, then have the following folder structure:

/home/git - git:git-readers u=rwx,g=rx,o=
/home/git/repositories - git:git u=rwx,g=rwx,o=rx

This will allow www-data into the folder for reading, but only give the git user write access. Any other user can't do anything.

If you want to add additional writers, I would add another group git-writers and add the users and git to it as well as the git-readers group, then use the following structure:

/home/git - git:git-readers u=rwx,g=rx,o=
/home/git/repositories - git:git-writers u=rwx,g=rwxs,o=rx

Note the 's' in the group permissions. This makes the writer users use git-writers group as their default group. This will only work properly if the writers are all umask 0002.

Andy
  • 3,705
  • 1
  • 19
  • 9
  • perfect thx. fyi: for some reason you need to restart apache after changing the permissions (and creating the git-readers group). seems like this was the problem in the first place, but not sure. – fetzig Dec 20 '10 at 14:20
  • Yes, only new processes gain newly added groups. Restarting apache is needed to do that. – Andy Dec 20 '10 at 14:30
  • this isn't working. newly created files in the repos have the wrong permissions. could you show me the chmod/own commands precisely. – fetzig Jan 10 '11 at 17:09
0

in case of gitolite push commits to git (gitolite) repository messes up file permissions (no more trac access)

Community
  • 1
fetzig
  • 251
  • 1
  • 6