If I disable git-shell's interactive mode by removing the
~/git-shell-commands directory, then attempts to use 'ssh' with the
git account interactively produce an error message intended for the

        $ ssh git@myserver
        fatal: Interactive git shell is not enabled.
        hint: ~/git-shell-commands should exist and have read and execute 

It is better to give the user a friendly hint that she is on the
right track, like GitHub does:

        Hi <username>! You've successfully authenticated, but
        GitHub does not provide shell access.

An appropriate greeting might even include more complex information,
like a list of repositories the user has access to.  A
git-shell-commands directory with only a "help" script can get us most
of the way there, but it unfortunately it produces a "git>" prompt
where the user can do nothing but ask for more help or exit.  So allow
the "help" script to abort the shell by exiting with nonzero status.

Downside: this will prevent interactive git-shell logins in existing
setups where the "help" script exits with nonzero status by mistake.
Hopefully those are rare enough to not cause much trouble in practice.

Reported-by: Ethan Reesor <firelizz...@gmail.com>
Signed-off-by: Jonathan Nieder <jrnie...@gmail.com>
Sitaram Chamarty wrote:

> Indeed!  In gitolite, I borrowed that idea added to it by making it
> print a list of repos you have access to, along with what permissions
> (R or RW) you have :-)
> I'm not suggesting git should do that, but instead of a fixed string,
> a default command to be executed would be better.

Good call.

> This of course now means that the ~/git-shell-commands should not be
> empty, since that is where this default command also will be present.

How about this?

A patch on top could change the default "git-shell-commands is not
present" message if that seems worthwhile.

 Documentation/git-shell.txt | 26 ++++++++++++++++++++++++++
 shell.c                     | 10 ++++++++--
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/Documentation/git-shell.txt b/Documentation/git-shell.txt
index 9b925060..758083ff 100644
--- a/Documentation/git-shell.txt
+++ b/Documentation/git-shell.txt
@@ -29,6 +29,32 @@ read and execute permissions to the directory in order to 
execute the
 programs in it. The programs are executed with a cwd of $HOME, and
 <argument> is parsed as a command-line string.
+When run interactively (with no arguments), 'git-shell' will
+automatically run `~/git-shell-commands/help` on startup, provided it
+exists.  If the 'help' command fails then the interactive shell is
+To disable interactive logins, displaying a greeting instead:
+$ chsh -s /usr/bin/git-shell
+$ mkdir $HOME/git-shell-commands
+$ cat >$HOME/git-shell-commands/help <<\EOF
+printf '%s\n' "Hi $USER! You've successfully authenticated, but I do not"
+printf '%s\n' "provide interactive shell access."
+exit 128
+$ chmod +x $HOME/git-shell-commands/help
 Part of the linkgit:git[1] suite
diff --git a/shell.c b/shell.c
index 84b237fe..3abc2b84 100644
--- a/shell.c
+++ b/shell.c
@@ -63,10 +63,16 @@ static void cd_to_homedir(void)
 static void run_shell(void)
-       int done = 0;
+       int done = 0, status;
        static const char *help_argv[] = { HELP_COMMAND, NULL };
        /* Print help if enabled */
-       run_command_v_opt(help_argv, RUN_SILENT_EXEC_FAILURE);
+       status = run_command_v_opt(help_argv, RUN_SILENT_EXEC_FAILURE);
+       if (!status)
+               ; /* success */
+       else if (status == -1 && errno == ENOENT)
+               ; /* help disabled */
+       else
+               exit(status);
        do {
                struct strbuf line = STRBUF_INIT;

To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to