|
| 1 | +//! Various permissions to define what can be done when operating a [`Repository`][crate::Repository]. |
| 2 | +use crate::open::Permissions; |
| 3 | +use gix_sec::Trust; |
| 4 | + |
| 5 | +/// Configure from which sources git configuration may be loaded. |
| 6 | +/// |
| 7 | +/// Note that configuration from inside of the repository is always loaded as it's definitely required for correctness. |
| 8 | +#[derive(Copy, Clone, Ord, PartialOrd, PartialEq, Eq, Debug, Hash)] |
| 9 | +pub struct Config { |
| 10 | + /// The git binary may come with configuration as part of its configuration, and if this is true (default false) |
| 11 | + /// we will load the configuration of the git binary, if present and not a duplicate of the ones below. |
| 12 | + /// |
| 13 | + /// It's disabled by default as it may involve executing the git binary once per execution of the application. |
| 14 | + pub git_binary: bool, |
| 15 | + /// Whether to use the system configuration. |
| 16 | + /// This is defined as `$(prefix)/etc/gitconfig` on unix. |
| 17 | + pub system: bool, |
| 18 | + /// Whether to use the git application configuration. |
| 19 | + /// |
| 20 | + /// A platform defined location for where a user's git application configuration should be located. |
| 21 | + /// If `$XDG_CONFIG_HOME` is not set or empty, `$HOME/.config/git/config` will be used |
| 22 | + /// on unix. |
| 23 | + pub git: bool, |
| 24 | + /// Whether to use the user configuration. |
| 25 | + /// This is usually `~/.gitconfig` on unix. |
| 26 | + pub user: bool, |
| 27 | + /// Whether to use the configuration from environment variables. |
| 28 | + pub env: bool, |
| 29 | + /// Whether to follow include files are encountered in loaded configuration, |
| 30 | + /// via `include` and `includeIf` sections. |
| 31 | + pub includes: bool, |
| 32 | +} |
| 33 | + |
| 34 | +impl Config { |
| 35 | + /// Allow everything which usually relates to a fully trusted environment |
| 36 | + pub fn all() -> Self { |
| 37 | + Config { |
| 38 | + git_binary: false, |
| 39 | + system: true, |
| 40 | + git: true, |
| 41 | + user: true, |
| 42 | + env: true, |
| 43 | + includes: true, |
| 44 | + } |
| 45 | + } |
| 46 | + |
| 47 | + /// Load only configuration local to the git repository. |
| 48 | + pub fn isolated() -> Self { |
| 49 | + Config { |
| 50 | + git_binary: false, |
| 51 | + system: false, |
| 52 | + git: false, |
| 53 | + user: false, |
| 54 | + env: false, |
| 55 | + includes: false, |
| 56 | + } |
| 57 | + } |
| 58 | +} |
| 59 | + |
| 60 | +impl Default for Config { |
| 61 | + fn default() -> Self { |
| 62 | + Self::all() |
| 63 | + } |
| 64 | +} |
| 65 | + |
| 66 | +/// Configure from which `gitattribute` files may be loaded. |
| 67 | +/// |
| 68 | +/// Note that `.gitattribute` files from within the repository are always loaded. |
| 69 | +#[derive(Copy, Clone, Ord, PartialOrd, PartialEq, Eq, Debug, Hash)] |
| 70 | +pub struct Attributes { |
| 71 | + /// The git binary may come with attribute configuration in its installation directory, and if this is true (default false) |
| 72 | + /// we will load the configuration of the git binary. |
| 73 | + /// |
| 74 | + /// It's disabled by default as it involves executing the git binary once per execution of the application. |
| 75 | + pub git_binary: bool, |
| 76 | + /// Whether to use the system configuration. |
| 77 | + /// This is typically defined as `$(prefix)/etc/gitconfig`. |
| 78 | + pub system: bool, |
| 79 | + /// Whether to use the git application configuration. |
| 80 | + /// |
| 81 | + /// A platform defined location for where a user's git application configuration should be located. |
| 82 | + /// If `$XDG_CONFIG_HOME` is not set or empty, `$HOME/.config/git/attributes` will be used |
| 83 | + /// on unix. |
| 84 | + pub git: bool, |
| 85 | +} |
| 86 | + |
| 87 | +impl Attributes { |
| 88 | + /// Allow everything which usually relates to a fully trusted environment |
| 89 | + pub fn all() -> Self { |
| 90 | + Attributes { |
| 91 | + git_binary: false, |
| 92 | + system: true, |
| 93 | + git: true, |
| 94 | + } |
| 95 | + } |
| 96 | + |
| 97 | + /// Allow loading attributes that are local to the git repository. |
| 98 | + pub fn isolated() -> Self { |
| 99 | + Attributes { |
| 100 | + git_binary: false, |
| 101 | + system: false, |
| 102 | + git: false, |
| 103 | + } |
| 104 | + } |
| 105 | +} |
| 106 | + |
| 107 | +impl Default for Attributes { |
| 108 | + fn default() -> Self { |
| 109 | + Self::all() |
| 110 | + } |
| 111 | +} |
| 112 | + |
| 113 | +/// Permissions related to the usage of environment variables |
| 114 | +#[derive(Debug, Clone, Copy)] |
| 115 | +pub struct Environment { |
| 116 | + /// Control whether resources pointed to by `XDG_CONFIG_HOME` can be used when looking up common configuration values. |
| 117 | + /// |
| 118 | + /// Note that [`gix_sec::Permission::Forbid`] will cause the operation to abort if a resource is set via the XDG config environment. |
| 119 | + pub xdg_config_home: gix_sec::Permission, |
| 120 | + /// Control the way resources pointed to by the home directory (similar to `xdg_config_home`) may be used. |
| 121 | + pub home: gix_sec::Permission, |
| 122 | + /// Control if environment variables to configure the HTTP transport, like `http_proxy` may be used. |
| 123 | + /// |
| 124 | + /// Note that http-transport related environment variables prefixed with `GIT_` may also be included here |
| 125 | + /// if they match this category like `GIT_HTTP_USER_AGENT`. |
| 126 | + pub http_transport: gix_sec::Permission, |
| 127 | + /// Control if the `EMAIL` environment variables may be read. |
| 128 | + /// |
| 129 | + /// Note that identity related environment variables prefixed with `GIT_` may also be included here |
| 130 | + /// if they match this category. |
| 131 | + pub identity: gix_sec::Permission, |
| 132 | + /// Control if environment variables related to the object database are handled. This includes features and performance |
| 133 | + /// options alike. |
| 134 | + pub objects: gix_sec::Permission, |
| 135 | + /// Control if resources pointed to by `GIT_*` prefixed environment variables can be used, **but only** if they |
| 136 | + /// are not contained in any other category. This is a catch-all section. |
| 137 | + pub git_prefix: gix_sec::Permission, |
| 138 | + /// Control if resources pointed to by `SSH_*` prefixed environment variables can be used (like `SSH_ASKPASS`) |
| 139 | + pub ssh_prefix: gix_sec::Permission, |
| 140 | +} |
| 141 | + |
| 142 | +impl Environment { |
| 143 | + /// Allow access to the entire environment. |
| 144 | + pub fn all() -> Self { |
| 145 | + let allow = gix_sec::Permission::Allow; |
| 146 | + Environment { |
| 147 | + xdg_config_home: allow, |
| 148 | + home: allow, |
| 149 | + git_prefix: allow, |
| 150 | + ssh_prefix: allow, |
| 151 | + http_transport: allow, |
| 152 | + identity: allow, |
| 153 | + objects: allow, |
| 154 | + } |
| 155 | + } |
| 156 | + |
| 157 | + /// Don't allow loading any environment variables. |
| 158 | + pub fn isolated() -> Self { |
| 159 | + let deny = gix_sec::Permission::Deny; |
| 160 | + Environment { |
| 161 | + xdg_config_home: deny, |
| 162 | + home: deny, |
| 163 | + ssh_prefix: deny, |
| 164 | + git_prefix: deny, |
| 165 | + http_transport: deny, |
| 166 | + identity: deny, |
| 167 | + objects: deny, |
| 168 | + } |
| 169 | + } |
| 170 | +} |
| 171 | + |
| 172 | +impl Permissions { |
| 173 | + /// Secure permissions are similar to `all()` |
| 174 | + pub fn secure() -> Self { |
| 175 | + Permissions { |
| 176 | + env: Environment::all(), |
| 177 | + config: Config::all(), |
| 178 | + attributes: Attributes::all(), |
| 179 | + } |
| 180 | + } |
| 181 | + |
| 182 | + /// Everything is allowed with this set of permissions, thus we read all configuration and do what git typically |
| 183 | + /// does with owned repositories. |
| 184 | + pub fn all() -> Self { |
| 185 | + Permissions { |
| 186 | + env: Environment::all(), |
| 187 | + config: Config::all(), |
| 188 | + attributes: Attributes::all(), |
| 189 | + } |
| 190 | + } |
| 191 | + |
| 192 | + /// Don't read any but the local git configuration and deny reading any environment variables. |
| 193 | + pub fn isolated() -> Self { |
| 194 | + Permissions { |
| 195 | + config: Config::isolated(), |
| 196 | + attributes: Attributes::isolated(), |
| 197 | + env: Environment::isolated(), |
| 198 | + } |
| 199 | + } |
| 200 | +} |
| 201 | + |
| 202 | +impl gix_sec::trust::DefaultForLevel for Permissions { |
| 203 | + fn default_for_level(level: Trust) -> Self { |
| 204 | + match level { |
| 205 | + Trust::Full => Permissions::all(), |
| 206 | + Trust::Reduced => Permissions::secure(), |
| 207 | + } |
| 208 | + } |
| 209 | +} |
| 210 | + |
| 211 | +impl Default for Permissions { |
| 212 | + fn default() -> Self { |
| 213 | + Permissions::secure() |
| 214 | + } |
| 215 | +} |
0 commit comments