0

OS: Ubuntu server 10.04 LTS

I have a strange issue going on with permissions and can't seem to track down what is causing it.

The setup is as follows:

Git Repository folders (and files in them) are owned by root, and the group we use for the projects has rws rights, for example:

   ll /path/to/project
   drwxrwsr-x 7 root project                4096 2013-03-14 19:19 project

Our jenkins user is member of the all the groups we create for the projects, including the one in the example. The jenkins application is started by the jenkins user to make sure it has full access to the project folders.

If i remove the read and execute rights for "others" on these git folders our builds fail, stating:

 fatal: '/path/to/project' does not appear to be a git repository

ps: no SELinux in play

  • I guess the question I have is, “Why are you mucking around with the permissions anyway?” – HalosGhost Jun 27 '14 at 1:30
  • Legacy server in a firm where i just started out, part of my security review revealed this potential weak spot in one of the dev servers. We have been getting more and more external devs and i don't want them to have any access at all on repo's they have no business with. Hence the mucking about with permissions. – Jake Jun 28 '14 at 11:43
1

I'm guessing it's your permissions with sub-directories within the repository.

# Set the same ownerships for every file and directory within the repository
sudo chown -R root:project /path/to/project

# Remove permissions for others on all files
sudo chmod o-rwx $(find /path/to/project -not -type d)

If you want group members to write back changes:

# Set permissions for all subdirectories
sudo chmod 2770 $(find /path/to/project -type d)

If you want group members to have read-only access:

# Remove write permissions for group members for every file
sudo chmod g-w $(find /path/to/project -not -type d)

# Set permissions for all subdirectories
sudo chmod 2750 $(find /path/to/project -type d)

Now, as long as the jenkins user is a member of the project group, he should be able to clone the git repository without a problem.

However, if you have SELinux enabled on your system, things could get a bit hairier.

Happy coding :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.