Re: [PATCH] Allow aliases to expand to shell commands

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

[view in full thread]

From: Johannes Schindelin <Johannes.Schindelin@...>

To: Theodore Tso <tytso@...>

Cc: Junio C Hamano <junkio@...>, <git@...>

Subject: Re: [PATCH] Allow aliases to expand to shell commands

Date: Sunday, February 11, 2007 - 12:03 pm

Hi,

On Sat, 10 Feb 2007, Theodore Tso wrote:

> On Sat, Feb 10, 2007 at 09:34:38PM +0100, Johannes Schindelin wrote:

quoted text

>
> > It made me feel a little uneasy that we can execute _any_ command now,
> > but I can only find one way to exploit this, when an attacker does not
> > have shell access anyway: git-shell.
>
> ... and git-shell only allows git-receive-pack and git-upload-pack to be
> called, with a single argument, and aliases aren't allowed to override
> commands. So we're safe here, I think.

Yes, sorry. I have a modified git-shell, which allows the git wrapper,
too, to allow setting the config. I'll just fix it here.

Ciao,
Dscho

-
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:

Git rescue mission, Bill Lear, (Wed Feb 7, 8:18 pm)

Re: Git rescue mission, Linus Torvalds, (Thu Feb 8, 1:27 pm)

Re: Git rescue mission, Kalle Pokki, (Thu Feb 8, 4:12 pm)

Re: Git rescue mission, Linus Torvalds, (Thu Feb 8, 5:23 pm)

Re: Git rescue mission, Kalle Pokki, (Thu Feb 8, 6:03 pm)

Re: Git rescue mission, Shawn O. Pearce, (Thu Feb 8, 6:10 pm)

Re: Git rescue mission, Kalle Pokki, (Fri Feb 9, 3:21 pm)

Re: Git rescue mission, Theodore Tso, (Thu Feb 8, 9:48 pm)

Re: Git rescue mission, Shawn O. Pearce, (Thu Feb 8, 9:58 pm)

Re: Git rescue mission, Theodore Ts'o, (Sat Feb 10, 12:05 pm)

[PATCH] Print a sane error message if an alias expands to an..., Theodore Ts'o, (Sat Feb 10, 12:05 pm)

Re: [PATCH] Print a sane error message if an alias expands t..., Junio C Hamano, (Sat Feb 10, 12:50 pm)

[PATCH] Allow aliases to expand to shell commands, Theodore Ts'o, (Sat Feb 10, 12:05 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Theodore Tso, (Sat Feb 10, 2:13 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Johannes Schindelin, (Sat Feb 10, 4:34 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Theodore Tso, (Sat Feb 10, 8:13 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Johannes Schindelin, (Sun Feb 11, 12:03 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Theodore Tso, (Sun Feb 11, 12:21 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Junio C Hamano, (Sun Feb 11, 5:44 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Theodore Tso, (Sun Feb 11, 11:56 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Shawn O. Pearce, (Mon Feb 12, 2:53 am)

Re: [PATCH] Allow aliases to expand to shell commands, Johannes Schindelin, (Sun Feb 11, 6:03 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Johannes Schindelin, (Sun Feb 11, 12:36 pm)

Re: [PATCH] Allow aliases to expand to shell commands, Linus Torvalds, (Sat Feb 10, 2:04 pm)

Re: Git rescue mission, Bill Lear, (Thu Feb 8, 5:57 pm)

Re: Git rescue mission, Linus Torvalds, (Thu Feb 8, 6:13 pm)

Re: Git rescue mission, Junio C Hamano, (Fri Feb 9, 12:38 am)

Re: Git rescue mission, Bill Lear, (Thu Feb 8, 7:25 pm)

Re: Git rescue mission, Linus Torvalds, (Thu Feb 8, 7:46 pm)

Re: Git rescue mission, Shawn O. Pearce, (Thu Feb 8, 7:33 pm)

Re: Git rescue mission, Bill Lear, (Thu Feb 8, 7:40 pm)

Re: Git rescue mission, Linus Torvalds, (Thu Feb 8, 8:17 pm)

Re: Git rescue mission, Michael S. Tsirkin, (Fri Feb 9, 4:58 am)

Re: Git rescue mission, Jakub Narebski, (Thu Feb 8, 8:03 pm)

Re: Git rescue mission, Shawn O. Pearce, (Thu Feb 8, 7:50 pm)

Re: Git rescue mission, Bill Lear, (Thu Feb 8, 6:33 pm)

Re: Git rescue mission, Jakub Narebski, (Thu Feb 8, 6:29 pm)

Re: Git rescue mission, Johannes Schindelin, (Wed Feb 7, 8:22 pm)

Re: Git rescue mission, Bill Lear, (Wed Feb 7, 8:24 pm)

Re: Git rescue mission, Johannes Schindelin, (Wed Feb 7, 8:25 pm)

Re: Git rescue mission, Bill Lear, (Wed Feb 7, 8:34 pm)

Re: Git rescue mission, Junio C Hamano, (Wed Feb 7, 8:48 pm)

Re: Git rescue mission, Alexander Litvinov, (Thu Feb 8, 12:28 am)

Re: Git rescue mission, Junio C Hamano, (Thu Feb 8, 8:53 pm)

Re: Git rescue mission, Alexander Litvinov, (Thu Feb 8, 11:32 pm)

Re: Git rescue mission, Bill Lear, (Thu Feb 8, 11:27 am)

Re: Git rescue mission, Jeff King, (Thu Feb 8, 7:24 pm)

Re: Git rescue mission, Bill Lear, (Thu Feb 8, 7:32 pm)


linux-kernel:
Greg Kroah-Hartman	[PATCH 012/196] nozomi driver
Ingo Molnar	Re: [patch 00/13] Syslets, "Threadlets", generic AIO support, v3
Rafael J. Wysocki	[PATCH -mm 5/6] Freezer: Remove PF_NOFREEZE from bluetooth threads
Ingo Molnar	Re: [PATCH 00/23] per device dirty throttling -v8
git:

linux-netdev:
David Miller	[GIT]: Networking
David Miller	Re: [PATCH] pkt_sched: Destroy gen estimators under rtnl_lock().
Gerrit Renker	[PATCH 15/37] dccp: Set per-connection CCIDs via socket options
Natalie Protasevich	[BUG] New Kernel Bugs
openbsd-misc:

Re: [PATCH] Allow aliases to expand to shell commands

Online users