From 406e9d8a7dd2a7a18f5bca215bb7e1346fd06128 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Thu, 30 Jul 2026 00:01:42 +0800
Subject: [PATCH] fix(jd): narrow repository sharing hook

---
 .../lake-lamp-authz/hooks/guanghu-ice-heart-post-receive   | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive b/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
index f3bf8d1..9c0aeb8 100755
--- a/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
+++ b/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
@@ -12,8 +12,11 @@ cd "$repo_dir"
 owner_uid=$(id -u)
 
 share_tree() {
-  find "$1" -user "$owner_uid" -type d -exec chmod g+rwx {} +
-  find "$1" -user "$owner_uid" -type f -exec chmod g+rw {} +
+  # RestrictSUIDSGID forbids chmod calls that preserve a setgid directory.
+  # Existing shared directories are already traversable, so touch only new
+  # private directories and use a numeric mode that drops the special bit.
+  find "$1" -user "$owner_uid" -type d ! -perm -g=x -exec chmod 0770 {} +
+  find "$1" -user "$owner_uid" -type f ! -perm -g=r -exec chmod g+r {} +
 }
 
 share_tree "$repo_dir/objects"