How to allow only a specific user to push commits to master branch

Question

I'm trying to setup a git server and I want to allow only a specific user to push commits to master branch.

I have tried to use the Linux group permission setting to meet the requirement above but it seems not a correct way.

And I even don't know what are the key words for searching the answer for this.

Any help would be appreciated.

https://stackoverflow.com/a/53599435/7976758 – phd Feb 18 '20 at 13:17 — phd, Feb 18 '20 at 13:17
https://stackoverflow.com/a/44246093/7976758 – phd Feb 18 '20 at 13:17 — phd, Feb 18 '20 at 13:17

Andrejs Cainikovs · Answer 1 · 2020-02-18T14:31:35.993

Git does not allow you to have private branches, but you can achieve this functionality by implementing your own server-side pre-receive hook. Github enterprise specific pre-receive hook example is here, as a reference.

However, if you are using Git hosting services (like Github) they might have an option for this. Github, in particular, has an option called branch restrictions, but it requires you to have a paid subscription, unless your project is public.

score 0 · Answer 2 · answered Feb 18 '20 at 14:40

You have two options:

By far the easiest solution is to use hosting software that already provides this functionality. You might want to look at GitLab, which has free options for both SaaS (hosted at gitlab.com) and self-managed instances (running your own gitlab instance). Or github. Or bitbucket. Or I'm sure there are others I'm not thinking of.

If you really don't want to use any of those, you can implement access control on a simple git server, but it's not so simple. The short (or rather, glib) answer is "hooks" - but a hook is just a script that runs when something happens - like in this case you'd use the prereceive hook, which runs when someone's trying to push and decides whether to accept the push. Now, how does your hook know who is pushing? (The commit metadata does not indicate who's pushing. What you need is authentication around the actual connection, and visibility of the authentication in your script so that the script may implement your authorization rules. That very quickly breaks down into "it depends on your environment".)

Since it's not really possible to exhaustively cover every scenario for doing this manually, hopefully either you'll find a pre-packaged solution you like, or you'll find the above to be enough to get you pointed in the right direction to do it manually.

Thank you for directed me the correct ways, it helps a lot. Thank you so much. — Alfie Wu, Feb 19 '20 at 02:29

How to allow only a specific user to push commits to master branch

2 Answers2