From: Jakub Narebski <jnareb@gmail.com>
To: Kyle Moffett <mrmacman_g4@mac.com>
Cc: git@vger.kernel.org
Subject: Re: Using GIT to store /etc (Or: How to make GIT store all file permission bits)
Date: Sun, 10 Dec 2006 19:26:32 +0100 [thread overview]
Message-ID: <200612101926.33307.jnareb@gmail.com> (raw)
In-Reply-To: <A52817B6-0265-4164-8E5D-334AF92DC267@mac.com>
Kyle Moffett wrote:
> On Dec 10, 2006, at 10:30:00, Jakub Narebski wrote:
>> Jeff Garzik wrote:
>>>
>>> I actively use git to version, store and distribute an exim mail
>>> configuration across six servers. So far my solution has been a
>>> 'fix perms' script, or using the file perm checking capabilities
>>> of cfengine.
>>
>> Fix perms' script used on a checkout hook is a best idea I think.
>
> Hmm, unfortunately that has problems with security-related race
> conditions when used directly for /etc. Think about what happens
> with "/etc/shadow" in that case, for example. (/etc/.git is of
> course 0700) I'm sure there are others where non-root daemons get
> unhappy when they get an inotify event and their config files have
> suddenly become root:root:0600. I also want to be able to "cd /etc
> && git status" to see what changed after running "apt-get update" or
> maybe fiddling in SWAT or webmin, so a makefile which installs into /
> etc won't quite solve it either. It would also be nice to see when
> things change the permissions on files in /etc, or even bind-mount an
> append-only volume over /etc/.git/objects to provide additional data
> security.
The idea is to not store /etc in git directly, but use import/export
scripts, which for example saves permissions and ownership in some
file also tracked by git on import, and restores correct permissions
on export. That is what I remember from this discussion. This of course
means that you would have to write your own porcelain...
What about mentioned in other email IsiSetup?
--
Jakub Narebski
Warsaw, Poland
next prev parent reply other threads:[~2006-12-10 18:24 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-12-10 13:40 Using GIT to store /etc (Or: How to make GIT store all file permission bits) Kyle Moffett
2006-12-10 14:49 ` Jeff Garzik
2006-12-10 15:30 ` Jakub Narebski
2006-12-10 18:10 ` Kyle Moffett
2006-12-10 18:18 ` Jakub Narebski
2006-12-10 18:26 ` Jakub Narebski [this message]
2006-12-10 18:35 ` Kyle Moffett
2006-12-11 10:39 ` Andreas Ericsson
2006-12-11 10:55 ` Jeff Garzik
2006-12-11 12:13 ` Josef Weidendorfer
2006-12-11 13:33 ` Johannes Schindelin
2006-12-11 15:07 ` Josef Weidendorfer
2006-12-10 15:06 ` Santi Béjar
2006-12-10 17:46 ` Kyle Moffett
2006-12-10 18:10 ` Jakub Narebski
2007-01-10 1:39 ` David Lang
2007-01-10 2:30 ` Shawn O. Pearce
2007-01-10 18:34 ` David Lang
2007-01-12 0:55 ` Shawn O. Pearce
2006-12-11 10:50 ` Nikolai Weibull
2006-12-12 3:45 ` Daniel Barkalow
2006-12-12 13:49 ` Kyle Moffett
2006-12-12 15:53 ` Andy Parkins
2006-12-12 22:49 ` Using git as a general backup mechanism (was Re: Using GIT to store /etc) Steven Grimm
2006-12-12 22:57 ` Johannes Schindelin
2006-12-12 23:06 ` Steven Grimm
2006-12-13 0:01 ` Johannes Schindelin
2006-12-12 23:15 ` Martin Langhoff
2006-12-12 23:23 ` Martin Langhoff
2006-12-12 23:43 ` Using git as a general backup mechanism Junio C Hamano
2006-12-14 23:33 ` Steven Grimm
2006-12-15 0:33 ` Junio C Hamano
2006-12-13 18:10 ` Using GIT to store /etc (Or: How to make GIT store all file permission bits) Daniel Barkalow
2006-12-14 5:06 ` Chris Riddoch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200612101926.33307.jnareb@gmail.com \
--to=jnareb@gmail.com \
--cc=git@vger.kernel.org \
--cc=mrmacman_g4@mac.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).