Sudoers config to allow arguments for git post-commit script

Question

We have a git post-commit script that needs to be run with Git and Trac, when someone commits something a hook is a called that runs the command:

trac-admin /path/to/trac changeset added "reponame" $REV

Where $REV is dynamic depending on the revision of the push. The problem is that this command requires that the committing user have write permission to the trac database.

We have many users committing, they are all in a Linux group called "git", I can give rw to this group on the trac DB file(SQLite) and it works however then anyone in the "git" group could delete the database. It is currently owned by www-data,www-data.

I added a sudo config line of this:

%git ALL=(www-data) NOPASSWD: /usr/local/bin/trac-admin

This works, it allows the script to work, however now they have all the options that come with trac-admin, I want to limit the access of this command to include the arguments of /path/to/trac, and change set added.

I tried adding a Cmnd Alias with the /usr/local/bin/trac-admin /path/to/trac changeset added "reponame" but it does not work because the added $REV is breaking it, and that cant be added dynamicly into /etc/sudoers.

Is there a way to include wildcards in Cmnd Alias to allow this to work in sudoers?

Random comment about the security of the machine... I'm assuming that these will be people committing remotely and that the reason they've been added as users to the physical machine is because you're accessing the repos using something like git+ssh? If this is the case, I think that the easiest solution would be to add write access for the git group to the trac db file and then use something like gitosis (see: http://scie.nti.st/2007/11/14/hosting-git-repositories-the-easy-and-secure-way) to manage physical ssh access to the machine. — photoionized, Apr 08 '11 at 18:25

score 2 · Answer 1 · answered Apr 08 '11 at 13:55

2

create a script which does only the thing you want to grant access to, then grant sudo access to that script instead of granting sudo access to trac-admin

answered Apr 08 '11 at 13:55

stew

9,263
1
28
43

score 1 · Accepted Answer · answered Apr 08 '11 at 14:16

Put in /usr/local/bin/whatever

#!/bin/bash --

reponame="$( printf '%q' "$1" )"
rev="$( printf '%q' "$2" )"

/usr/local/bin/trac-admin /path/to/trac changeset added "$reponame" "$rev"

Then use /usr/local/bin/whatever in sudoers. Let users these instructions:

sudo whatever repo rev

Sudoers config to allow arguments for git post-commit script

2 Answers2