I'm trying to set up a git server on my FreeNAS server. The problem I have is with setting up the permissions for different users/groups just as I want.
Basically I have two different groups:
git-auth-user which contains all users that should have
rwx access to the directory containing all repositories (I should limit
x to directories only I'd think, but for now that's a little detail) and
git-unauth-user which is basically just the git daemon that should hand out read only access.
I thought that running
setfacl -m "g:git-auth-user:rwx:fd:allow" git/ would work to give my
git-auth-user all rights, but that doesn't happen.
From searching it seems like the classic permissions still limit the overall permissions ACLs can hand out, does this mean I have to basically give
others full rights (so basically
chmod 777 dir)? But then I assume everybody that doesn't get their rights limited via ACLs would then have full access as well which is obviously not what I want.
Is there any way around having to set the classic permission rights for
other to the most permissive I want to hand out via ACLs or if not, is there an ACL that completely denies access to everybody that doesn't get special access rights?
ls -la (so
chmod 770 for the directory)
drwxrwx---+ 2 root wheel 2 Jun 22 23:45 git
$ getfacl git/ # file: git/ # owner: root # group: wheel group:git-auth-user:rwx-----------:fd----:allow owner@:rwxp--aARWcCos:------:allow group@:rwxp--a-R-c--s:------:allow everyone@:------a-R-c--s:------:allow
Now when a user of the group
git-auth-user tries to generate a new directory inside the
git directory I get
$ mkdir test.git mkdir: test.git: Permission denied
On the other hand if I use
chmod -R 777 git it works just fine, but that's obviously a really bad solution because I give everybody complete access to the directory, while my dream solution would be no access for everyone except
git-auth-user (i.e. my user
git-ro also has write access to the directory, now I could specifically remove all rights for that user per ACLs, but this obviously doesn't scale. I'm sure there must be a better solution to this that I'm overlooking).