I have a shared git repository set up, which users pull from with the
I would like to set up the permissions in a way that only users in a specific user group (e.g.
git_group) may access the repository. I can make created files accessible by this group, either by using:
chmod g+s. Recursively:
find . -type d print0 | xargs -0 chmod g+s.
- Set defaults in the access control lists.
sudo setfacl -R -m g:git_group:rwx .and
sudo setfacl -R -d -m g:git_group:rwx .
This all seems fine until you remove a user from
git_group. When that user pushed commits, they became owner of some files in the git repository. After being removed from the group, that user may still modify those files, and some git commands may still succeed.
Changing the owner of all files in the git repository would deny the user access to the repository, but is it possible to set up the repository so that users are denied access simply by removing them from the group?
As far as I know, with basic linux file permissions, the group being given more permission than the owner leads to undefined behaviour.