On Sat, Jun 05, 2021 at 10:47:32AM +0200, Sebastien Marie wrote:
> On Fri, Jun 04, 2021 at 02:54:42PM +0200, Stefan Sperling wrote:
> > On Fri, Jun 04, 2021 at 01:08:02AM +0200, Stefan Sperling wrote:
> > > This patch is my current state of 'gotadmin pack' work.
> > 
> > New version with some fixes:
> > 
> > - only pack referenced objects, drop support for packing anything loose
> > - both including and excluding a ref is no longer an error (will be excluded)
> > - tweak progress output
> > - pack tag objects
> > - ignore refs/got/*
> > 
> > I don't expect detailed code review since this patch is very large.
> > It would be nice to get some test reports though.
> 
> patch applied on top of current
> 
> $ gotadmin pack -a
> gotadmin: mkstemp: Permission denied
> 
> With ktrace:
> 
>  57079 gotadmin CALL  open(0x48c50fd2700,0xa02<O_RDWR|O_CREAT|O_EXCL>,0600<S_IRUSR|S_IWUSR>)
>  57079 gotadmin NAMI  "/var/git/openbsd/got.git/objects/pack/packing.pack-xvkc3c"
>  57079 gotadmin RET   open -1 errno 13 Permission denied
> 
> And it seems that "/var/git/openbsd/got.git" is unveiled with "r" only.

Indeed. Of course I did all my testing in /tmp which is always unveiled rwc :)

The fix is trivial, so I'm not re-sending the entire patch. Apply on top:

-----------------------------------------------
commit 68508b442956da1ed6bf72b3f99fa91eb6c8479c (packcreate)
from: Stefan Sperling <stsp@stsp.name>
date: Sat Jun  5 09:09:19 2021 UTC
 
 packing requires unveiling the repository read/write; found by semarie
 
diff f5c4805f5090ec7c0ee9d2f9019705b653805941 803cfb90ccac5bfb9ac77ba7fa3034e2b583d7ec
blob - 090d85e840f61e0caff5c3956bfd96897183cdc0
blob + 624efcfd12132d41ed3c551e9867041820d77686
--- gotadmin/gotadmin.c
+++ gotadmin/gotadmin.c
@@ -569,7 +569,7 @@ cmd_pack(int argc, char *argv[])
 	if (error)
 		goto done;
 
-	error = apply_unveil(got_repo_get_path_git_dir(repo), 1);
+	error = apply_unveil(got_repo_get_path_git_dir(repo), 0);
 	if (error)
 		goto done;