acl.py
471 lines
| 14.1 KiB
| text/x-python
|
PythonLexer
/ hgext / acl.py
|
r2344 | # acl.py - changeset access control for mercurial | ||
# | ||||
# Copyright 2006 Vadim Gelfer <vadim.gelfer@gmail.com> | ||||
# | ||||
|
r8225 | # This software may be used and distributed according to the terms of the | ||
|
r10263 | # GNU General Public License version 2 or any later version. | ||
|
r8873 | |||
|
r8935 | '''hooks for controlling repository access | ||
|
r8873 | |||
|
r11095 | This hook makes it possible to allow or deny write access to given | ||
branches and paths of a repository when receiving incoming changesets | ||||
via pretxnchangegroup and pretxncommit. | ||||
|
r9250 | |||
The authorization is matched based on the local user name on the | ||||
system where the hook runs, and not the committer of the original | ||||
changeset (since the latter is merely informative). | ||||
|
r8873 | |||
|
r9250 | The acl hook is best used along with a restricted shell like hgsh, | ||
|
r11095 | preventing authenticating users from doing anything other than pushing | ||
or pulling. The hook is not safe to use if users have interactive | ||||
shell access, as they can then disable the hook. Nor is it safe if | ||||
remote users share an account, because then there is no way to | ||||
distinguish them. | ||||
|
r8873 | |||
|
r11092 | The order in which access checks are performed is: | ||
|
r11094 | |||
1) Deny list for branches (section ``acl.deny.branches``) | ||||
2) Allow list for branches (section ``acl.allow.branches``) | ||||
3) Deny list for paths (section ``acl.deny``) | ||||
4) Allow list for paths (section ``acl.allow``) | ||||
|
r11042 | |||
|
r11092 | The allow and deny sections take key-value pairs. | ||
|
r11094 | Branch-based Access Control | ||
|
r17267 | --------------------------- | ||
|
r11092 | |||
|
r11095 | Use the ``acl.deny.branches`` and ``acl.allow.branches`` sections to | ||
have branch-based access control. Keys in these sections can be | ||||
either: | ||||
|
r11057 | |||
|
r11095 | - a branch name, or | ||
- an asterisk, to match any branch; | ||||
|
r11092 | |||
The corresponding values can be either: | ||||
|
r11094 | |||
|
r11095 | - a comma-separated list containing users and groups, or | ||
- an asterisk, to match anyone; | ||||
|
r11042 | |||
|
r16957 | You can add the "!" prefix to a user or group name to invert the sense | ||
of the match. | ||||
|
r11094 | Path-based Access Control | ||
|
r17267 | ------------------------- | ||
|
r11092 | |||
|
r11095 | Use the ``acl.deny`` and ``acl.allow`` sections to have path-based | ||
access control. Keys in these sections accept a subtree pattern (with | ||||
a glob syntax by default). The corresponding values follow the same | ||||
syntax as the other sections above. | ||||
|
r11092 | |||
r38550 | Bookmark-based Access Control | |||
----------------------------- | ||||
Use the ``acl.deny.bookmarks`` and ``acl.allow.bookmarks`` sections to | ||||
have bookmark-based access control. Keys in these sections can be | ||||
either: | ||||
- a bookmark name, or | ||||
- an asterisk, to match any bookmark; | ||||
The corresponding values can be either: | ||||
- a comma-separated list containing users and groups, or | ||||
- an asterisk, to match anyone; | ||||
You can add the "!" prefix to a user or group name to invert the sense | ||||
of the match. | ||||
Note: for interactions between clients and servers using Mercurial 3.6+ | ||||
a rejection will generally reject the entire push, for interactions | ||||
involving older clients, the commit transactions will already be accepted, | ||||
and only the bookmark movement will be rejected. | ||||
|
r11094 | Groups | ||
|
r17267 | ------ | ||
|
r11092 | |||
|
r11095 | Group names must be prefixed with an ``@`` symbol. Specifying a group | ||
name has the same effect as specifying all the users in that group. | ||||
|
r8873 | |||
|
r11115 | You can define group members in the ``acl.groups`` section. | ||
If a group name is not defined there, and Mercurial is running under | ||||
a Unix-like system, the list of users will be taken from the OS. | ||||
Otherwise, an exception will be raised. | ||||
|
r11094 | Example Configuration | ||
|
r17267 | --------------------- | ||
|
r11094 | |||
:: | ||||
|
r8873 | |||
[hooks] | ||||
|
r11042 | |||
|
r11092 | # Use this if you want to check access restrictions at commit time | ||
|
r11042 | pretxncommit.acl = python:hgext.acl.hook | ||
|
r11423 | |||
|
r11095 | # Use this if you want to check access restrictions for pull, push, | ||
# bundle and serve. | ||||
|
r8873 | pretxnchangegroup.acl = python:hgext.acl.hook | ||
[acl] | ||||
|
r11131 | # Allow or deny access for incoming changes only if their source is | ||
# listed here, let them pass otherwise. Source is "serve" for all | ||||
# remote access (http or ssh), "push", "pull" or "bundle" when the | ||||
# related commands are run locally. | ||||
# Default: serve | ||||
|
r8893 | sources = serve | ||
|
r8873 | |||
|
r11423 | [acl.deny.branches] | ||
# Everyone is denied to the frozen branch: | ||||
frozen-branch = * | ||||
# A bad user is denied on all branches: | ||||
* = bad-user | ||||
[acl.allow.branches] | ||||
# A few users are allowed on branch-a: | ||||
branch-a = user-1, user-2, user-3 | ||||
# Only one user is allowed on branch-b: | ||||
branch-b = user-1 | ||||
# The super user is allowed on any branch: | ||||
* = super-user | ||||
# Everyone is allowed on branch-for-tests: | ||||
branch-for-tests = * | ||||
|
r11092 | |||
|
r11042 | [acl.deny] | ||
|
r11095 | # This list is checked first. If a match is found, acl.allow is not | ||
# checked. All users are granted access if acl.deny is not present. | ||||
# Format for both lists: glob pattern = user, ..., @group, ... | ||||
|
r11042 | |||
# To match everyone, use an asterisk for the user: | ||||
# my/glob/pattern = * | ||||
# user6 will not have write access to any file: | ||||
** = user6 | ||||
# Group "hg-denied" will not have write access to any file: | ||||
** = @hg-denied | ||||
|
r17537 | # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite | ||
|
r11095 | # everyone being able to change all other files. See below. | ||
|
r17537 | src/main/resources/DONT-TOUCH-THIS.txt = * | ||
|
r8873 | |||
[acl.allow] | ||||
|
r11131 | # if acl.allow is not present, all users are allowed by default | ||
|
r11042 | # empty acl.allow = no users allowed | ||
|
r11095 | # User "doc_writer" has write access to any file under the "docs" | ||
# folder: | ||||
|
r8873 | docs/** = doc_writer | ||
|
r11042 | |||
|
r11095 | # User "jack" and group "designers" have write access to any file | ||
# under the "images" folder: | ||||
|
r11042 | images/** = jack, @designers | ||
|
r16499 | # Everyone (except for "user6" and "@hg-denied" - see acl.deny above) | ||
# will have write access to any file under the "resources" folder | ||||
# (except for 1 file. See acl.deny): | ||||
|
r11042 | src/main/resources/** = * | ||
|
r8873 | .hgtags = release_engineer | ||
|
r16957 | Examples using the "!" prefix | ||
............................. | ||||
Suppose there's a branch that only a given user (or group) should be able to | ||||
push to, and you don't want to restrict access to any other branch that may | ||||
be created. | ||||
The "!" prefix allows you to prevent anyone except a given user or group to | ||||
push changesets in a given branch or path. | ||||
In the examples below, we will: | ||||
1) Deny access to branch "ring" to anyone but user "gollum" | ||||
2) Deny access to branch "lake" to anyone but members of the group "hobbit" | ||||
3) Deny access to a file to anyone but user "gollum" | ||||
:: | ||||
[acl.allow.branches] | ||||
# Empty | ||||
[acl.deny.branches] | ||||
# 1) only 'gollum' can commit to branch 'ring'; | ||||
# 'gollum' and anyone else can still commit to any other branch. | ||||
ring = !gollum | ||||
# 2) only members of the group 'hobbit' can commit to branch 'lake'; | ||||
# 'hobbit' members and anyone else can still commit to any other branch. | ||||
lake = !@hobbit | ||||
# You can also deny access based on file paths: | ||||
[acl.allow] | ||||
# Empty | ||||
[acl.deny] | ||||
# 3) only 'gollum' can change the file below; | ||||
# 'gollum' and anyone else can still change any other file. | ||||
/misty/mountains/cave/ring = !gollum | ||||
|
r8873 | ''' | ||
|
r2344 | |||
|
r28089 | from __future__ import absolute_import | ||
|
r3891 | from mercurial.i18n import _ | ||
|
r28089 | from mercurial import ( | ||
error, | ||||
|
r34830 | extensions, | ||
|
r28089 | match, | ||
|
r38806 | pycompat, | ||
r33182 | registrar, | |||
|
r28089 | util, | ||
) | ||||
|
r43346 | from mercurial.utils import procutil | ||
|
r11041 | |||
|
r28883 | urlreq = util.urlreq | ||
|
r29841 | # Note for extension authors: ONLY specify testedwith = 'ships-with-hg-core' for | ||
|
r25186 | # extensions which SHIP WITH MERCURIAL. Non-mainline extensions should | ||
# be specifying the version(s) of Mercurial they are tested with, or | ||||
# leave the attribute unspecified. | ||||
|
r43347 | testedwith = b'ships-with-hg-core' | ||
|
r16743 | |||
r33182 | configtable = {} | |||
configitem = registrar.configitem(configtable) | ||||
# deprecated config: acl.config | ||||
|
r43346 | configitem( | ||
|
r43347 | b'acl', b'config', default=None, | ||
r33182 | ) | |||
|
r43346 | configitem( | ||
|
r43347 | b'acl.groups', b'.*', default=None, generic=True, | ||
|
r34780 | ) | ||
|
r43346 | configitem( | ||
|
r43347 | b'acl.deny.branches', b'.*', default=None, generic=True, | ||
|
r34780 | ) | ||
|
r43346 | configitem( | ||
|
r43347 | b'acl.allow.branches', b'.*', default=None, generic=True, | ||
|
r34780 | ) | ||
|
r43346 | configitem( | ||
|
r43347 | b'acl.deny', b'.*', default=None, generic=True, | ||
|
r34780 | ) | ||
|
r43346 | configitem( | ||
|
r43347 | b'acl.allow', b'.*', default=None, generic=True, | ||
|
r34780 | ) | ||
|
r43346 | configitem( | ||
|
r43347 | b'acl', b'sources', default=lambda: [b'serve'], | ||
r33183 | ) | |||
r33182 | ||||
|
r43346 | |||
|
r11114 | def _getusers(ui, group): | ||
# First, try to use group definition from section [acl.groups] | ||||
|
r43347 | hgrcusers = ui.configlist(b'acl.groups', group) | ||
|
r11114 | if hgrcusers: | ||
return hgrcusers | ||||
|
r43347 | ui.debug(b'acl: "%s" not defined in [acl.groups]\n' % group) | ||
|
r11114 | # If no users found in group definition, get users from OS-level group | ||
|
r11140 | try: | ||
return util.groupmembers(group) | ||||
except KeyError: | ||||
|
r43347 | raise error.Abort(_(b"group '%s' is undefined") % group) | ||
|
r11041 | |||
|
r43346 | |||
|
r11114 | def _usermatch(ui, user, usersorgroups): | ||
|
r11041 | |||
|
r43347 | if usersorgroups == b'*': | ||
|
r11041 | return True | ||
|
r43347 | for ug in usersorgroups.replace(b',', b' ').split(): | ||
|
r16956 | |||
|
r43347 | if ug.startswith(b'!'): | ||
|
r16956 | # Test for excluded user or group. Format: | ||
# if ug is a user name: !username | ||||
# if ug is a group name: !@groupname | ||||
ug = ug[1:] | ||||
|
r43346 | if ( | ||
|
r43347 | not ug.startswith(b'@') | ||
|
r43346 | and user != ug | ||
|
r43347 | or ug.startswith(b'@') | ||
|
r43346 | and user not in _getusers(ui, ug[1:]) | ||
): | ||||
|
r16956 | return True | ||
# Test for user or group. Format: | ||||
# if ug is a user name: username | ||||
# if ug is a group name: @groupname | ||||
|
r43347 | elif ( | ||
user == ug or ug.startswith(b'@') and user in _getusers(ui, ug[1:]) | ||||
): | ||||
|
r11041 | return True | ||
return False | ||||
|
r2344 | |||
|
r43346 | |||
|
r6766 | def buildmatch(ui, repo, user, key): | ||
'''return tuple of (match function, list enabled).''' | ||||
if not ui.has_section(key): | ||||
|
r43347 | ui.debug(b'acl: %s not enabled\n' % key) | ||
|
r6766 | return None | ||
|
r2344 | |||
|
r43346 | pats = [ | ||
pat for pat, users in ui.configitems(key) if _usermatch(ui, user, users) | ||||
] | ||||
ui.debug( | ||||
|
r43347 | b'acl: %s enabled, %d entries for user %s\n' % (key, len(pats), user) | ||
|
r43346 | ) | ||
|
r11092 | |||
|
r16765 | # Branch-based ACL | ||
|
r11092 | if not repo: | ||
if pats: | ||||
|
r16766 | # If there's an asterisk (meaning "any branch"), always return True; | ||
# Otherwise, test if b is in pats | ||||
|
r43347 | if b'*' in pats: | ||
|
r16766 | return util.always | ||
return lambda b: b in pats | ||||
|
r16764 | return util.never | ||
|
r11092 | |||
|
r16765 | # Path-based ACL | ||
|
r6766 | if pats: | ||
|
r43347 | return match.match(repo.root, b'', pats) | ||
|
r16767 | return util.never | ||
|
r2344 | |||
|
r43346 | |||
|
r34830 | def ensureenabled(ui): | ||
"""make sure the extension is enabled when used as hook | ||||
When acl is used through hooks, the extension is never formally loaded and | ||||
enabled. This has some side effect, for example the config declaration is | ||||
never loaded. This function ensure the extension is enabled when running | ||||
hooks. | ||||
""" | ||||
|
r43347 | if b'acl' in ui._knownconfig: | ||
|
r34830 | return | ||
|
r43347 | ui.setconfig(b'extensions', b'acl', b'', source=b'internal') | ||
extensions.loadall(ui, [b'acl']) | ||||
|
r34830 | |||
|
r43346 | |||
|
r2344 | def hook(ui, repo, hooktype, node=None, source=None, **kwargs): | ||
|
r34830 | |||
ensureenabled(ui) | ||||
|
r43347 | if hooktype not in [b'pretxnchangegroup', b'pretxncommit', b'prepushkey']: | ||
r38550 | raise error.Abort( | |||
|
r43346 | _( | ||
|
r43347 | b'config error - hook type "%s" cannot stop ' | ||
b'incoming changesets, commits, nor bookmarks' | ||||
|
r43346 | ) | ||
% hooktype | ||||
) | ||||
|
r43347 | if hooktype == b'pretxnchangegroup' and source not in ui.configlist( | ||
b'acl', b'sources' | ||||
|
r43346 | ): | ||
|
r43347 | ui.debug(b'acl: changes have source "%s" - skipping\n' % source) | ||
|
r2344 | return | ||
|
r8846 | user = None | ||
|
r43347 | if source == b'serve' and r'url' in kwargs: | ||
url = kwargs[r'url'].split(b':') | ||||
if url[0] == b'remote' and url[1].startswith(b'http'): | ||||
|
r28883 | user = urlreq.unquote(url[3]) | ||
|
r8846 | |||
if user is None: | ||||
|
r37138 | user = procutil.getuser() | ||
|
r8846 | |||
|
r43347 | ui.debug(b'acl: checking access for user "%s"\n' % user) | ||
|
r15207 | |||
|
r43347 | if hooktype == b'prepushkey': | ||
r38550 | _pkhook(ui, repo, hooktype, node, source, user, **kwargs) | |||
else: | ||||
_txnhook(ui, repo, hooktype, node, source, user, **kwargs) | ||||
|
r43346 | |||
r38550 | def _pkhook(ui, repo, hooktype, node, source, user, **kwargs): | |||
|
r43347 | if kwargs[r'namespace'] == b'bookmarks': | ||
|
r39458 | bookmark = kwargs[r'key'] | ||
ctx = kwargs[r'new'] | ||||
|
r43347 | allowbookmarks = buildmatch(ui, None, user, b'acl.allow.bookmarks') | ||
denybookmarks = buildmatch(ui, None, user, b'acl.deny.bookmarks') | ||||
r38550 | ||||
if denybookmarks and denybookmarks(bookmark): | ||||
|
r43346 | raise error.Abort( | ||
|
r43347 | _( | ||
b'acl: user "%s" denied on bookmark "%s"' | ||||
b' (changeset "%s")' | ||||
) | ||||
|
r43346 | % (user, bookmark, ctx) | ||
) | ||||
r38550 | if allowbookmarks and not allowbookmarks(bookmark): | |||
|
r43346 | raise error.Abort( | ||
_( | ||||
|
r43347 | b'acl: user "%s" not allowed on bookmark "%s"' | ||
b' (changeset "%s")' | ||||
|
r43346 | ) | ||
% (user, bookmark, ctx) | ||||
) | ||||
ui.debug( | ||||
|
r43347 | b'acl: bookmark access granted: "%s" on bookmark "%s"\n' | ||
|
r43346 | % (ctx, bookmark) | ||
) | ||||
r38550 | ||||
def _txnhook(ui, repo, hooktype, node, source, user, **kwargs): | ||||
|
r25792 | # deprecated config: acl.config | ||
|
r43347 | cfg = ui.config(b'acl', b'config') | ||
|
r6766 | if cfg: | ||
|
r43346 | ui.readconfig( | ||
cfg, | ||||
sections=[ | ||||
|
r43347 | b'acl.groups', | ||
b'acl.allow.branches', | ||||
b'acl.deny.branches', | ||||
b'acl.allow', | ||||
b'acl.deny', | ||||
|
r43346 | ], | ||
) | ||||
|
r11092 | |||
|
r43347 | allowbranches = buildmatch(ui, None, user, b'acl.allow.branches') | ||
denybranches = buildmatch(ui, None, user, b'acl.deny.branches') | ||||
allow = buildmatch(ui, repo, user, b'acl.allow') | ||||
deny = buildmatch(ui, repo, user, b'acl.deny') | ||||
|
r6766 | |||
|
r38806 | for rev in pycompat.xrange(repo[node].rev(), len(repo)): | ||
|
r6766 | ctx = repo[rev] | ||
|
r11092 | branch = ctx.branch() | ||
if denybranches and denybranches(branch): | ||||
|
r43346 | raise error.Abort( | ||
|
r43347 | _(b'acl: user "%s" denied on branch "%s"' b' (changeset "%s")') | ||
|
r43346 | % (user, branch, ctx) | ||
) | ||||
|
r11092 | if allowbranches and not allowbranches(branch): | ||
|
r43346 | raise error.Abort( | ||
_( | ||||
|
r43347 | b'acl: user "%s" not allowed on branch "%s"' | ||
b' (changeset "%s")' | ||||
|
r43346 | ) | ||
% (user, branch, ctx) | ||||
) | ||||
ui.debug( | ||||
|
r43347 | b'acl: branch access granted: "%s" on branch "%s"\n' % (ctx, branch) | ||
|
r43346 | ) | ||
|
r11092 | |||
|
r6766 | for f in ctx.files(): | ||
if deny and deny(f): | ||||
|
r43346 | raise error.Abort( | ||
|
r43347 | _(b'acl: user "%s" denied on "%s"' b' (changeset "%s")') | ||
|
r43346 | % (user, f, ctx) | ||
) | ||||
|
r6766 | if allow and not allow(f): | ||
|
r43346 | raise error.Abort( | ||
|
r43347 | _( | ||
b'acl: user "%s" not allowed on "%s"' | ||||
b' (changeset "%s")' | ||||
) | ||||
|
r43346 | % (user, f, ctx) | ||
) | ||||
|
r43347 | ui.debug(b'acl: path access granted: "%s"\n' % ctx) | ||