Make a git repository read-only over ssh depending on the key used

Question

I want a git repository, accessible over ssh, to be read-only when used with certain keys. With other keys access to the full system is okay.

Here is my solution.

git-readonlyshell:

if echo "2ドル" | egrep -q ^git-upload-pack; then
 sh -c "2ドル"
else
 echo Error: read only access 1>&2
fi

.ssh/authorized_keys:

command="./git-readonlyshell -c \"$SSH_ORIGINAL_COMMAND\"" ...

Thoughts?

Any scenario in which this would break?

• rolfl: Why not just have a user that is read-only for the repository and use one user for full-access, and the other for read-only?
• nafg: @rolfl I could. But then I have to specify a longer path after the :, meaning user@server:/full/path/to/repo
• ChrisWue: @nafg: Can you please roll back your last edit if it was in response to GoodPerson's answer? The answer becomes somewhat pointless when you edit your question like this.
• Gareth Rees: @ChrisWue: I rolled back the edit, so that the answer makes sense again. nafg: If you want to ask a follow-up question, you should append it to the original question instead of changing your question.
• nafg: @ChrisWue: trying to recall, are you talking about the fact that I added "Any scenario in which this would break?" If so no, it was no in response to GoodPerson's answer, it was my original intention and I realized I had been unclear.

Answer 1

Should be

printf "%s\n" "2ドル" | grep -E "^git-upload-pack" && sh -c "2ドル"

Notes:

• sh not bash for portability
• The printf instead of echo is for safety. What happens if someone puts "-n foo" as "2ドル"?

• fumiyas: It is insecure. The $SSH_ORIGINAL_COMMAND can contain multiple command-lines, e.g., git-upload-pack dummy; cat /etc/passwd.