Fix exec error on git protocol endpoints

Changes

5 changed files (+101/-12)

• main.go
  • @@ -7,6 +7,7 @@ import (
    "log" "net/http" "os" + "os/exec" "github.com/pocka/legit/config" "github.com/pocka/legit/embed"
  • @@ -53,18 +54,49 @@ func main() {
    log.Fatal(err) } - allowedDirs := make([]string, 1, 3) - allowedDirs[0] = c.Repo.ScanPath + fsAllowList := make([]filesystemAccess, 2, 5) + fsAllowList[0] = filesystemAccess{ + path: c.Repo.ScanPath, + isDir: true, + read: true, + } + + // os.exec.Cmd use /dev/null. Without this, git operations fail with + // "open /dev/null: permission denied". + // https://rohitpaulk.com/articles/cmd-run-dev-null + fsAllowList[1] = filesystemAccess{ + path: "/dev/null", + read: true, + write: true, + } + + if path, err := exec.LookPath("git"); err != nil { + log.Printf("Unable to find git binary, git operations will fail: %s", err) + } else { + fsAllowList = append(fsAllowList, filesystemAccess{ + path: path, + read: true, + execute: true, + }) + } if c.Dirs.Static != "" { - allowedDirs = append(allowedDirs, c.Dirs.Static) + fsAllowList = append(fsAllowList, filesystemAccess{ + path: c.Dirs.Static, + isDir: true, + read: true, + }) } if c.Dirs.Templates != "" { - allowedDirs = append(allowedDirs, c.Dirs.Templates) + fsAllowList = append(fsAllowList, filesystemAccess{ + path: c.Dirs.Templates, + isDir: true, + read: true, + }) } - if err := restrictFileAccessTo(allowedDirs...); err != nil { + if err := restrictFileAccessTo(fsAllowList...); err != nil { log.Fatalf("Unable to restrict filesystem access: %s", err) }
• restrictfs.go (new)
  • @@ -0,0 +1,18 @@
    + // Copyright 2026 Shota FUJI <pockawoooh@gmail.com> + // SPDX-License-Identifier: MIT + + package main + + type filesystemAccess struct { + path string + isDir bool + + // read allows read operations. + read bool + + // write allows write operations. + write bool + + // execute allows execute operations (run a process). + execute bool + }
• restrictfs_linux.go
  • @@ -11,8 +11,29 @@ import (
    "github.com/landlock-lsm/go-landlock/landlock" ) - func restrictFileAccessTo(dirs ...string) error { - err := landlock.V9.BestEffort().RestrictPaths(landlock.RODirs(dirs...)) + func restrictFileAccessTo(allowList ...filesystemAccess) error { + rules := make([]landlock.Rule, 0, len(allowList)) + for _, a := range allowList { + var rule landlock.Rule + + if a.isDir { + if a.write { + rule = landlock.RWDirs(a.path) + } else { + rule = landlock.RODirs(a.path) + } + } else { + if a.write { + rule = landlock.RWFiles(a.path) + } else { + rule = landlock.ROFiles(a.path) + } + } + + rules = append(rules, rule) + } + + err := landlock.V9.BestEffort().RestrictPaths(rules...) if err != nil { return fmt.Errorf("Landlock error: %w", err)
• restrictfs_noop.go
  • @@ -4,6 +4,6 @@
    package main - func restrictFileAccessTo(_dirs ...string) error { + func restrictFileAccessTo(_dirs ...filesystemAccess) error { return nil }
• restrictfs_openbsd.go
  • @@ -8,10 +8,28 @@ import (
    "golang.org/x/sys/unix" ) - func restrictFileAccessTo(dirs ...string) error { - for _, dir := range dirs { - if err := unix.Unveil(dir, "r"); err != nil { - return fmt.Errorf("Unveil error (%s): %w", dir, err) + func (a filesystemAccess) mode() string { + m := "" + + if a.read { + m = m + "r" + } + + if a.write { + m = m + "w" + } + + if a.execute { + m = m + "x" + } + + return m + } + + func restrictFileAccessTo(allowList ...filesystemAccess) error { + for _, a := range allowList { + if err := unix.Unveil(a.path, a.mode()); err != nil { + return fmt.Errorf("Unveil error (%s:%s): %w", a.path, a.mode(), err) } }