Using sudo to secure git deployment via web script

Question

I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility.

Briefly, how it works it:

1. I commit to Bitbucket
2. Bitbucket POSTs to a specified script (which only runs if it's called from BB's IP Address)
3. My script chdirs to the appropriate directory, runs git reset, and git pull to update to latest version (it's a php script using exec()).

I got the idea from:

http://www.stephenradford.me/blog/tutorials/deploy-via-bitbucket-or-github-service-hooks

And overall it seems ok, but it has one major security concern for me - to make it work, you'd need to give apache write access to/ownership of the site directory to do the deployment. This strikes me as a Bad Idea, because then an attacker use apache to write arbitrary files within the directory.

My idea as an alternative is to:

1. Create another user, 'deploy' then make that the user which owns the site directory.
2. Use sudoers to enable apache to run a specific shell script as user deploy, and put my git reset, pull command etc in that shell script.
3. In my exec() calls, do e.g. "sudo -u deploy shell-script.sh"

Can anyone see any flaws/holes with this?

Answer 1

Calling sudo from apache just doesn't sound right, despite the fact that I can't put my finger on the exact set of reasons why it would be a bad idea.

I would suggest instead of doing sudo to just run a very simple CGI as "suexecusergroup deploy" that would receive the postback from bitbucket and perform the git commands. This is a lot more straightforward and sane.