Ask HN: How can I create a webserver that runs Git commands securely?

Re:Ask HN: How can I create a webserver that runs Git comman... by lesserknowndan on Thursday March 30, 2023 @06:30AM (#35370554)

Look into using ‘sudo’. Sudo is not just for running things as root. It can also be used to allow a web service (Apache+PHP) to call a specific program (git) as a specific user (e.g. nobody).

[ Parent | on HN ]

Re:Ask HN: How can I create a webserver that runs Git comman... by quickthrower2 on Thursday March 30, 2023 @07:16AM (#35370919)

You mean “su”?

[ Parent | on HN ]

Re:Ask HN: How can I create a webserver that runs Git comman... by chatmasta on Thursday March 30, 2023 @10:26AM (#35373172)

sudo -u nobody git pull

That said, "nobody" will have its own challenges, like the lack of a $HOME meaning there is no git config file for the user, meaning you'll need to add a bunch of specific arguments to every git command. You might want to create a locked down user just for running git.

[ Parent | on HN ]

Re:Ask HN: How can I create a webserver that runs Git comman... by compressedgas on Friday March 31, 2023 @03:03AM (#35383646)

I heard that sudo due to PAM wasn't a means of dropping privileges.

[ Parent | on HN ]