acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups

hgext/acl.py

@@ -1,232 +1,240
 # acl.py - changeset access control for mercurial
 #
 # Copyright 2006 Vadim Gelfer <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 '''hooks for controlling repository access
 
 This hook makes it possible to allow or deny write access to given
 branches and paths of a repository when receiving incoming changesets
 via pretxnchangegroup and pretxncommit.
 
 The authorization is matched based on the local user name on the
 system where the hook runs, and not the committer of the original
 changeset (since the latter is merely informative).
 
 The acl hook is best used along with a restricted shell like hgsh,
 preventing authenticating users from doing anything other than pushing
 or pulling. The hook is not safe to use if users have interactive
 shell access, as they can then disable the hook. Nor is it safe if
 remote users share an account, because then there is no way to
 distinguish them.
 
 The order in which access checks are performed is:
 
 1) Deny  list for branches (section ``acl.deny.branches``)
 2) Allow list for branches (section ``acl.allow.branches``)
 3) Deny  list for paths    (section ``acl.deny``)
 4) Allow list for paths    (section ``acl.allow``)
 
 The allow and deny sections take key-value pairs.
 
 Branch-based Access Control
 ---------------------------
 
 Use the ``acl.deny.branches`` and ``acl.allow.branches`` sections to
 have branch-based access control. Keys in these sections can be
 either:
 
 - a branch name, or
 - an asterisk, to match any branch;
 
 The corresponding values can be either:
 
 - a comma-separated list containing users and groups, or
 - an asterisk, to match anyone;
 
 Path-based Access Control
 -------------------------
 
 Use the ``acl.deny`` and ``acl.allow`` sections to have path-based
 access control. Keys in these sections accept a subtree pattern (with
 a glob syntax by default). The corresponding values follow the same
 syntax as the other sections above.
 
 Groups
 ------
 
 Group names must be prefixed with an ``@`` symbol. Specifying a group
 name has the same effect as specifying all the users in that group.
 
 Example Configuration
 ---------------------
 
 ::
 
   [hooks]
 
   # Use this if you want to check access restrictions at commit time
   pretxncommit.acl = python:hgext.acl.hook
   
   # Use this if you want to check access restrictions for pull, push,
   # bundle and serve.
   pretxnchangegroup.acl = python:hgext.acl.hook
 
   [acl]
   # Check whether the source of incoming changes is in this list where
   # "serve" == ssh or http, and "push", "pull" and "bundle" are the
   # corresponding hg commands.
   sources = serve
 
   [acl.deny.branches] 
   
   # Everyone is denied to the frozen branch: 
   frozen-branch = * 
   
   # A bad user is denied on all branches: 
   * = bad-user 
   
   [acl.allow.branches] 
   
   # A few users are allowed on branch-a: 
   branch-a = user-1, user-2, user-3 
   
   # Only one user is allowed on branch-b: 
   branch-b = user-1 
   
   # The super user is allowed on any branch: 
   * = super-user 
   
   # Everyone is allowed on branch-for-tests: 
   branch-for-tests = * 
 
   [acl.deny]
   # This list is checked first. If a match is found, acl.allow is not
   # checked. All users are granted access if acl.deny is not present.
   # Format for both lists: glob pattern = user, ..., @group, ...
 
   # To match everyone, use an asterisk for the user:
   # my/glob/pattern = *
 
   # user6 will not have write access to any file:
   ** = user6
 
   # Group "hg-denied" will not have write access to any file:
   ** = @hg-denied
 
   # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite
   # everyone being able to change all other files. See below.
   src/main/resources/DONT-TOUCH-THIS.txt = *
 
   [acl.allow]
   # if acl.allow not present, all users allowed by default
   # empty acl.allow = no users allowed
 
   # User "doc_writer" has write access to any file under the "docs"
   # folder:
   docs/** = doc_writer
 
   # User "jack" and group "designers" have write access to any file
   # under the "images" folder:
   images/** = jack, @designers
 
   # Everyone (except for "user6" - see acl.deny above) will have write
   # access to any file under the "resources" folder (except for 1
   # file. See acl.deny):
   src/main/resources/** = *
 
   .hgtags = release_engineer
 
 '''
 
 from mercurial.i18n import _
 from mercurial import util, match
 import getpass, urllib, grp
 
-def _getusers(group):
+def _getusers(ui, group):
+
+    # First, try to use group definition from section [acl.groups]
+    hgrcusers = ui.configlist('acl.groups', group)
+    if hgrcusers:
+        return hgrcusers
+
+    ui.debug('acl: "%s" not defined in [acl.groups]\n' % group)
+    # If no users found in group definition, get users from OS-level group
     return grp.getgrnam(group).gr_mem
 
-def _usermatch(user, usersorgroups):
+def _usermatch(ui, user, usersorgroups):
 
     if usersorgroups == '*':
         return True
 
     for ug in usersorgroups.replace(',', ' ').split():
-        if user == ug or ug.find('@') == 0 and user in _getusers(ug[1:]):
+        if user == ug or ug.find('@') == 0 and user in _getusers(ui, ug[1:]):
             return True
 
     return False
 
 def buildmatch(ui, repo, user, key):
     '''return tuple of (match function, list enabled).'''
     if not ui.has_section(key):
         ui.debug('acl: %s not enabled\n' % key)
         return None
 
     pats = [pat for pat, users in ui.configitems(key)
-            if _usermatch(user, users)]
+            if _usermatch(ui, user, users)]
     ui.debug('acl: %s enabled, %d entries for user %s\n' %
              (key, len(pats), user))
 
     if not repo:
         if pats:
             return lambda b: '*' in pats or b in pats
         return lambda b: False
 
     if pats:
         return match.match(repo.root, '', pats)
     return match.exact(repo.root, '', [])
 
 
 def hook(ui, repo, hooktype, node=None, source=None, **kwargs):
     if hooktype not in ['pretxnchangegroup', 'pretxncommit']:
         raise util.Abort(_('config error - hook type "%s" cannot stop '
                            'incoming changesets nor commits') % hooktype)
     if (hooktype == 'pretxnchangegroup' and
         source not in ui.config('acl', 'sources', 'serve').split()):
         ui.debug('acl: changes have source "%s" - skipping\n' % source)
         return
 
     user = None
     if source == 'serve' and 'url' in kwargs:
         url = kwargs['url'].split(':')
         if url[0] == 'remote' and url[1].startswith('http'):
             user = urllib.unquote(url[3])
 
     if user is None:
         user = getpass.getuser()
 
     cfg = ui.config('acl', 'config')
     if cfg:
-        ui.readconfig(cfg, sections = ['acl.allow.branches',
+        ui.readconfig(cfg, sections = ['acl.groups', 'acl.allow.branches',
         'acl.deny.branches', 'acl.allow', 'acl.deny'])
 
     allowbranches = buildmatch(ui, None, user, 'acl.allow.branches')
     denybranches = buildmatch(ui, None, user, 'acl.deny.branches')
     allow = buildmatch(ui, repo, user, 'acl.allow')
     deny = buildmatch(ui, repo, user, 'acl.deny')
 
     for rev in xrange(repo[node], len(repo)):
         ctx = repo[rev]
         branch = ctx.branch()
         if denybranches and denybranches(branch):
             raise util.Abort(_('acl: user "%s" denied on branch "%s"'
                                ' (changeset "%s")')
                                % (user, branch, ctx))
         if allowbranches and not allowbranches(branch):
             raise util.Abort(_('acl: user "%s" not allowed on branch "%s"'
                                ' (changeset "%s")')
                                % (user, branch, ctx))
         ui.debug('acl: branch access granted: "%s" on branch "%s"\n'
         % (ctx, branch))
 
         for f in ctx.files():
             if deny and deny(f):
                 ui.debug('acl: user %s denied on %s\n' % (user, f))
                 raise util.Abort(_('acl: access denied for changeset %s') % ctx)
             if allow and not allow(f):
                 ui.debug('acl: user %s not allowed on %s\n' % (user, f))
                 raise util.Abort(_('acl: access denied for changeset %s') % ctx)
         ui.debug('acl: allowing changeset %s\n' % ctx)

tests/test-acl

@@ -1,162 +1,168
 #!/bin/sh
 
 do_push()
 {
     user=$1
     shift
 
     echo "Pushing as user $user"
     echo 'hgrc = """'
     sed -e 1,2d b/.hg/hgrc | grep -v "$HGTMP"
     echo '"""'
     if test -f acl.config; then
 	echo 'acl.config = """'
 	cat acl.config
 	echo '"""'
     fi
     # On AIX /etc/profile sets LOGNAME read-only. So
     #  LOGNAME=$user hg --cws a --debug push ../b
     # fails with "This variable is read only."
     # Use env to work around this.
     env LOGNAME=$user hg --cwd a --debug push ../b
     hg --cwd b rollback
     hg --cwd b --quiet tip
     echo
 }
 
 init_config()
 {
 cat > fakegroups.py <<EOF
 from hgext import acl
-acl._getusers = lambda x: ["fred", "betty"]
+def fakegetusers(ui, group):
+    try:
+        return acl._getusersorig(ui, group)
+    except:
+        return ["fred", "betty"]
+acl._getusersorig = acl._getusers
+acl._getusers = fakegetusers
 EOF
 
 rm -f acl.config
 cat > $config <<EOF
 [hooks]
 pretxnchangegroup.acl = python:hgext.acl.hook
 [acl]
 sources = push
 [extensions]
 f=$PWD/fakegroups.py
 EOF
 }
 
 hg init a
 cd a
 mkdir foo foo/Bar quux
 echo 'in foo' > foo/file.txt
 echo 'in foo/Bar' > foo/Bar/file.txt
 echo 'in quux' > quux/file.py
 hg add -q
 hg ci -m 'add files' -d '1000000 0'
 echo >> foo/file.txt
 hg ci -m 'change foo/file' -d '1000001 0'
 echo >> foo/Bar/file.txt
 hg ci -m 'change foo/Bar/file' -d '1000002 0'
 echo >> quux/file.py
 hg ci -m 'change quux/file' -d '1000003 0'
 hg tip --quiet
 
 cd ..
 hg clone -r 0 a b
 
 echo '[extensions]' >> $HGRCPATH
 echo 'acl =' >> $HGRCPATH
 
 config=b/.hg/hgrc
 
 echo
 
 echo 'Extension disabled for lack of a hook'
 do_push fred
 
 echo '[hooks]' >> $config
 echo 'pretxnchangegroup.acl = python:hgext.acl.hook' >> $config
 
 echo 'Extension disabled for lack of acl.sources'
 do_push fred
 
 echo 'No [acl.allow]/[acl.deny]'
 echo '[acl]' >> $config
 echo 'sources = push' >> $config
 do_push fred
 
 echo 'Empty [acl.allow]'
 echo '[acl.allow]' >> $config
 do_push fred
 
 echo 'fred is allowed inside foo/'
 echo 'foo/** = fred' >> $config
 do_push fred
 
 echo 'Empty [acl.deny]'
 echo '[acl.deny]' >> $config
 do_push barney
 
 echo 'fred is allowed inside foo/, but not foo/bar/ (case matters)'
 echo 'foo/bar/** = fred' >> $config
 do_push fred
 
 echo 'fred is allowed inside foo/, but not foo/Bar/'
 echo 'foo/Bar/** = fred' >> $config
 do_push fred
 
 echo 'barney is not mentioned => not allowed anywhere'
 do_push barney
 
 echo 'barney is allowed everywhere'
 echo '[acl.allow]' >> $config
 echo '** = barney' >> $config
 do_push barney
 
 echo 'wilma can change files with a .txt extension'
 echo '**/*.txt = wilma' >> $config
 do_push wilma
 
 echo 'file specified by acl.config does not exist'
 echo '[acl]' >> $config
 echo 'config = ../acl.config' >> $config
 do_push barney
 
 echo 'betty is allowed inside foo/ by a acl.config file'
 echo '[acl.allow]' >> acl.config
 echo 'foo/** = betty' >> acl.config
 do_push betty
 
 echo 'acl.config can set only [acl.allow]/[acl.deny]'
 echo '[hooks]' >> acl.config
 echo 'changegroup.acl = false' >> acl.config
 do_push barney
 
 # asterisk
 
 init_config
 
 echo 'asterisk test'
 echo '[acl.allow]' >> $config
 echo "** = fred" >> $config
 echo "fred is always allowed"
 do_push fred
 
 echo '[acl.deny]' >> $config
 echo "foo/Bar/** = *" >> $config
 echo "no one is allowed inside foo/Bar/"
 do_push fred
 
 # Groups
 
 init_config
 
 echo 'OS-level groups'
 echo '[acl.allow]' >> $config
 echo "** = @group1" >> $config
 echo "@group1 is always allowed"
 do_push fred
 
 echo '[acl.deny]' >> $config
 echo "foo/Bar/** = @group1" >> $config
 echo "@group is allowed inside anything but foo/Bar/"
 do_push fred