I have a shared git repository set up, which users pull from with the ssh protocol.

I would like to set up the permissions in a way that only users in a specific user group (e.g. git_group) may access the repository. I can make created files accessible by this group, either by using:

  • Setgid: chmod g+s. Recursively: find . -type d print0 | xargs -0 chmod g+s.
  • Set defaults in the access control lists.
    • sudo setfacl -R -m g:git_group:rwx . and
    • sudo setfacl -R -d -m g:git_group:rwx .

This all seems fine until you remove a user from git_group. When that user pushed commits, they became owner of some files in the git repository. After being removed from the group, that user may still modify those files, and some git commands may still succeed.

Changing the owner of all files in the git repository would deny the user access to the repository, but is it possible to set up the repository so that users are denied access simply by removing them from the group?

As far as I know, with basic linux file permissions, the group being given more permission than the owner leads to undefined behaviour.

  • 1
    The behavior if the group has more permissions than the user is perfectly well defined. – Gilles May 5 '15 at 23:33
  • @Gilles: Thanks, I should have said the group permissions are ignored when the user owns the file. – Zantier May 6 '15 at 9:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.