cgit about-filter in chroot (httpd + slowcgi)

[Paul W. Rankin]

Hello,

I'm running cgit with httpd + slowcgi and can't seem to get the
about-filter to work. Both httpd and slowcgi run in the default chroot
of /var/www.

I've compiled lowdown with "-static -pie" to /var/www/bin/lowdown
(chroot /bin/lowdown) with permissions:

-rwxr-xr-x 1 root bin 1325512 Mar 4 01:38 /var/www/bin/lowdown

In my cgitrc (cgit.conf):

about-filter=/bin/lowdown
readme=:README.md

However, upon visiting an About page of a repo that includes a
README.md, I get only a blank page and the following is logged in
error.log:

lowdown: README.md: No such file or directory

Here's the cgit server section in httpd.conf:

server "git.bydasein.com" {
listen on * port 80
listen on * tls port 443
root "/cgi-bin/cgit.cgi"
tls {
certificate "/etc/ssl/bydasein.com.fullchain.pem"
key "/etc/ssl/private/bydasein.com.key"
}
location "/.well-known/acme-challenge/*" {
root "/acme"
request strip 2
}
location "/robots.txt" {
root "/htdocs/git.bydasein.com"
no fastcgi
}
location "/favicon.ico" {
root "/htdocs/git.bydasein.com"
no fastcgi
}
location "/cgit.css" {
root "/htdocs/git.bydasein.com"
no fastcgi
}
location "/custom.css" {
root "/htdocs/git.bydasein.com"
no fastcgi
}
fastcgi {
socket "/run/slowcgi.sock"
param CGIT_CONFIG "/conf/cgit.conf"
}
}

I'm pretty sure I can have this work if I disable the chroot in httpd
and/or slowcgi, but I'd prefer a solution that doesn't require that.

Does anyone have any ideas? Has anyone managed to get cgit running on
OpenBSD using httpd + slowcgi with chroot enabled?

Thanks for your time :)

[Paul W. Rankin]

Instead of downloading, recompiling, and installing lowdown; then
building and installing a program that execs the downloaded lowdown;
why don't you cut out the first step and call through to the C API
installed with the lowdown port? There's a full example in the
EXAMPLES section of lowdown_file(3).

Sorry Kristaps I didn't see this because I was not previous subscribed
to the list. Thanks for pointing me in this direction, it does look like
the optimal approach. At my current point in The C Programming Language
book the example still looks like Greek to me (I'm not up to structs or
pointers) but one day...

Thanks!

[Stuart Henderson]

$ cat <<EOF > my-cgit-filter.c
#include <unistd.h>
int
main(void)
{
execl("/bin/lowdown", "lowdown", NULL);
return 1;
}
EOF

So essentially all this is doing is stripping off the command line
arguments.

$ cc my-cgit-filter.c -o my-cgit-filter.c -static

output file overwrites the input file here ^^

Instead of downloading, recompiling, and installing lowdown; then
building and installing a program that execs the downloaded lowdown; why
don't you cut out the first step and call through to the C API installed
with the lowdown port? There's a full example in the EXAMPLES section
of lowdown_file(3).

Alternatively you can copy the lowdown binary from the package, along
with libc/libm/ld.so, into the chroot (which can be done from /etc/rc.local).
Then there's no need to recompile things for future lowdown updates.