I host my own git repository on a VPS. Let's say my user is john.

I'm using the ssh protocol to access my git repository, so my url is something like ssh://john@myserver.com/path/to/git/myrepo/.

Root is the owner of everything that's under /path/to/git

I'm attempting to give read/write access to john to everything which is under /path/to/git/myrepo

I've tried both chmod and setfacl to control access, but both fail the same way: they apply rights recursively (with the right options) to all the current existing subdirectories of /path/to/git/myrepo, but as soon as a new directory is created, my user can not write in the new directory.

I know that there are hooks in git that would allow me to reapply the rights after each commit, but I'm starting to think that I'm going the wrong way because this seems too complicated for a very basic purpose.

Q: How should I set up my right to give rw access to john to anything under /path/to/git/myrepo and make it resilient to tree structure change?

Q2: If I should take a step back change the general approach, please tell me.

Edit: The question was answered as is, but that was the wrong question. The right question would have been "How to configure a bare git repository on the server for use with ssh access?". See my own answer.

migrated from serverfault.com Sep 28 '12 at 14:50

This question came from our site for system and network administrators.


create a group myrepousers for example, and add your git users to that group.

Then change the group of everything under /path/to/git/myrepo to myrepousers:

chown -R .myrepousers /path/to/git/myrepo

Then fix the permissions:

chmod -R g+w /path/to/git/myrepo
find /path/to/git/myrepo -type d -exec chmod -R {} g+s \;

Should be all set.

  • 2
    If you want to understand what's going on here Samuel, Google for "setgid". The magic here is in the g+s. Of course you'll have to first understand the basics of chmod too. – iconoclast Sep 28 '12 at 16:25
  • I Thought I had understood how to do that with +s on the directory but it did not do what I expected: permissions were not transmitted to new directories. What do last and 3rd last tokens mean: {} and \ Thanks in advance. – Samuel Rossille Oct 1 '12 at 14:42
  • {} - is a placeholder for file name substitution. ; is the terminator of command executed by -exec. As ; has special meaning in bash it has to be escaped with \. see man find for details – Serge Oct 1 '12 at 16:10

Actually that was the wrong approach. After additionnal researches, I found out that in my case I have to user git's buildin features to handle filesystem's right in the repository.

It's basically done with the shared option of git init, which can have (among other) the following values:

  • group: initialize the repository so that files and directories have user and group write access, and everybody else has read access
  • 0660: same but without read access for the others.

The newly created directories and files automatically have the right permissions. You can also use git init on an existing repository to reconfigure it without loosing it's content.

So in the end what I had to do:

  • Create a group mygitrepo
  • Add users to it
  • chmod -R the git repository to root:mygitrepo

And now every users of the group can pull / push, and nobody else can, and that without messing with the file system rights.

git init --bare --shared=0660

http://www.kernel.org/pub/software/scm/git/docs/git-init.html for more information.


If ACLs are supported, you can do it with default ACLs. Beware that it's easy to forget about those as they don't show up when you do an ls -l.

find /path/to/git/myrepo -type d -exec setfacl -m d:u:john:rwx {} +

But, I suspect you may want to do something a bit more organised. Deploying gitolite may provide a better solution.

  • 1
    At least with Debian Wheezy's ls (and I think Squeeze too) you get a + at the end of the permissions to say there is an ACL: drwxr-xr-x+ 2 anthony anthony 4096 Sep 28 11:16 i-have-an-acl – derobert Sep 28 '12 at 15:18
  • Thanks this works, but could you please clarify the meaning of the two last tokens: {} + – Samuel Rossille Oct 1 '12 at 14:22
  • That's find ... -exec cmd {} + syntax, where {} is replaced with as many found file names as possible (as oppsed to {} \; where {} is only replaced with one found file at a time) – Stéphane Chazelas Oct 1 '12 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.