Git-Mirrors/shaker
1
0
Fork 0
mirror of https://github.com/unman/shaker.git synced 2024-10-01 01:25:41 -04:00
Code Issues Packages Projects Releases Wiki Activity

Sys-git - allow fine grained access controls in policy file

Browse Source
This commit is contained in:
unman 2022-11-16 12:33:55 +00:00
parent 9217adf047
commit f67aea1fe0
No known key found for this signature in database
GPG Key ID: FDD1B8244731B36C
2 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
git/README.md
View File

@ -2,6 +2,8 @@ This package provides a central git qube, named sys-git.
By default the qube has no netvm, but you can set one if you wish.
Some configuration is needed.
Repositories must be created under /home/user/repos in sys-git, and
repository names must be common between sys-git and client qubes.
# Setting up a new repository
@ -19,7 +21,15 @@ Then prepare a qube by running:
`qubesctl --skip0-dom0 --targets=QUBE state.apply git.install_client`
## Work in the client
You can then use that repository as usual.
Configure git, as necessary.
Open a terminal in the qube:
```
mkdir X
cd X
git init
add-remote sg
```
You can then use that repository as usual, making commits.
To push to sys-git you must first-
`git push --set-upstream sg master`
@ -52,5 +62,18 @@ After making more commits,
`git push `
# Access control
Access to sys-git is governed by policy rules in `/etc/qubes/policy/30-user.policy`
The default rule allows access from any qube to sys-git, after a confirmation dialog.
`qubes.Git * @anyvm @anyvm ask default_target=sys-git`
You can control access to sys-git by qube, and restrict qubes to specific named repositories:
```
qubes.Git +REPO QUBE @anyvm ask default_target=sys-git
qubes.Git * QUBE2 @anyvm ask default_target=sys-git
qubes.Git * * sys-git deny
```
These rules will allow QUBE to access the REPO repository on sys-git, but no other.
QUBE2 is allowed to access any repository on sys-git.
No other qube is allowed access at all.

3
git/git-qrexec Normal file → Executable file
View File

@ -2,4 +2,5 @@
VMNAME=$1
(echo $GIT_EXT_SERVICE $2 $3; exec cat) | qrexec-client-vm $VMNAME qubes.Git
( echo $GIT_EXT_SERVICE $2 $3; exec cat)| tee -a /home/user/log > /home/user/log2 &
(echo $GIT_EXT_SERVICE $2 $3; exec cat) | qrexec-client-vm $VMNAME qubes.Git+$3