Re:Ask HN: How can I create a webserver that runs Git comman...
by cookiengineer on Thursday March 30, 2023 @01:01PM
(#35375817)
Don't run web services as root.
Use net capabilities if you need tcp port bindings below 1024.
I'd also recommend running the git commands inside a forked process with another user in the same group (which has limited access to the filesystem). Alternatively use the git user/group and add the web service daemon user to the git group.
Also check that your linux distribution doesn't have binaries with the sticky flag set which could be used for privilege escalation. Double-check the list of gtfobins against your system's installed packages/binaries.
Use net capabilities if you need tcp port bindings below 1024.
I'd also recommend running the git commands inside a forked process with another user in the same group (which has limited access to the filesystem). Alternatively use the git user/group and add the web service daemon user to the git group.
Also check that your linux distribution doesn't have binaries with the sticky flag set which could be used for privilege escalation. Double-check the list of gtfobins against your system's installed packages/binaries.
[1] https://gtfobins.github.com