Date: Thu, 5 Apr 2001 11:02:39 +0100 (BST) From: jan.grant@bristol.ac.uk To: FreeBSD-gnats-submit@freebsd.org Subject: gnu/26362: "cvs server" doesn't honour the global --allow-root Message-ID: <200104051002.f35A2dv49999@tribble.ilrt.bris.ac.uk>
next in thread | raw e-mail | index | archive | help
>Number: 26362 >Category: gnu >Synopsis: "cvs server" doesn't honour the global --allow-root >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Thu Apr 05 03:10:01 PDT 2001 >Closed-Date: >Last-Modified: >Originator: jan grant >Release: FreeBSD 4.3-RC i386 >Organization: ILRT, University of Bristol >Environment: System: FreeBSD tribble.ilrt.bris.ac.uk 4.3-RC FreeBSD 4.3-RC #0: Tue Apr 3 12:19:35 BST 2001 cmjg@tribble.ilrt.bris.ac.uk:/external/usr.obj/usr/src/sys/JAN i386 GENERIC kernel (+ sound support) - not that it matters. Stock CVS from a buildworld. >Description: I was surprised to find that "cvs --allow-root=/blah server" doesn't honour the global flag. This is a shame since I'm trying to get secure ssh-based access to CVS, using sshd's 'command="cvs --allow-root=/blah server"' in ~/.ssh/authorized_keys2 - this seems to be the standard way to get ssh access to CVS. (Summary of setup at http://ioctl.org/unix/cvs/server ) >How-To-Repeat: Just try it. >Fix: *** src/cvs.h.orig Mon Apr 2 15:37:18 2001 --- src/cvs.h Mon Apr 2 15:37:46 2001 *************** *** 463,468 **** --- 463,469 ---- void root_allow_add PROTO ((char *)); void root_allow_free PROTO ((void)); int root_allow_ok PROTO ((char *)); + int root_allow_ok_or_unspecified PROTO ((char *)); char *gca PROTO((const char *rev1, const char *rev2)); extern void check_numeric PROTO ((const char *, int, char **)); *** src/root.c.orig Mon Apr 2 15:36:56 2001 --- src/root.c Mon Apr 2 15:38:27 2001 *************** *** 265,270 **** --- 265,284 ---- return 0; } + int + root_allow_ok_or_unspecified (arg) + char *arg; + { + int i; + + if (root_allow_count == 0) return 1; + + for (i = 0; i < root_allow_count; ++i) + if (strcmp (root_allow_vector[i], arg) == 0) + return 1; + return 0; + } + /* This global variable holds the global -d option. It is NULL if -d was not used, which means that we must get the CVSroot information from the CVSROOT environment variable or from a CVS/Root file. */ *** src/server.c.orig Mon Apr 2 15:35:54 2001 --- src/server.c Mon Apr 2 15:47:43 2001 *************** *** 794,799 **** --- 794,812 ---- } } #endif + if (!root_allow_ok_or_unspecified(arg)) { + if (alloc_pending (80 + strlen (arg))) + /* If cvs server was run with --allow-root, we ensure + that the root given is a valid one. + Useful for using :ext: communication to + a cvs server via ssh with + Command "cvs --allow-root=/blah server" + in the ssh config. */ + sprintf (pending_error_text, "\ + E Protocol error: Root cannot be \"%s\"", + arg); + return; + } set_local_cvsroot (arg); /* For pserver, this will already have happened, and the call will do >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200104051002.f35A2dv49999>