For posterity, the issue was that the `git` command itself needs to be in the jail also. This is not written down anywhere. I only determined it after reading the source code for `git-http-backend`.
This is my init script now: # cd /var/www # for c in git git-http-backend git-upload-pack git-receive-pack ; do for f in `ldd /usr/local/libexec/git/$c | grep '/usr/' | grep -v ':' | awk '{print $7}'`; do d=`dirname $f | sed 's#^/##'` mkdir -p $d cp $f $d done done Also, regarding the rewrite rules mentioned before, they are only needed if wanting to discriminate between `git` and web requests pointing to the same URL. Kent