{"thread":{"id":"55301","subject":"git credential cache and sudo","startedAt":"2021-03-12T16:44:46Z","lastAt":"2021-03-15T18:57:29Z","messageCount":5,"participants":["John Ratliff","Jeff King","Jonathan Nieder"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"418975","messageId":"CAP8UukjW_TeswTHHfiwzc989U+wZMVcHeS1siRF0Rbg5nc3D5w@mail.gmail.com","threadId":"55301","inReplyTo":null,"subject":"git credential cache and sudo","fromName":"John Ratliff","fromEmail":"john@technoplaza.net","sentAt":"2021-03-12T16:43:46Z","receivedAt":"2021-03-12T16:44:46Z","isPatch":false,"sender":{"key":"john@technoplaza.net","avatar":null},"body":"When I do sudo git pull, git does not know about my credential cache.\n\nOn some servers, when I do a sudo -E git pull, it can find my\ncredential cache and use it. On other servers, I think the sudo\nconfiguration is stripping the environment, so this doesn't work and I\nstill have to enter my git credentials.\n\nWhat environment variables do I need to configure sudo to preserve to\nmake sudo -E git pull work with my credential cache? Or is there\nsomething else I can pass to git or define to get it to use my\ncredential cache?\n\nThanks.\n\n--John\n"},{"id":"418997","messageId":"YEvPQS1+1sxd/aGw@coredump.intra.peff.net","threadId":"55301","inReplyTo":"CAP8UukjW_TeswTHHfiwzc989U+wZMVcHeS1siRF0Rbg5nc3D5w@mail.gmail.com","subject":"Re: git credential cache and sudo","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2021-03-12T20:29:53Z","receivedAt":"2021-03-12T20:30:52Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Mar 12, 2021 at 11:43:46AM -0500, John Ratliff wrote:\n\n> When I do sudo git pull, git does not know about my credential cache.\n> \n> On some servers, when I do a sudo -E git pull, it can find my\n> credential cache and use it. On other servers, I think the sudo\n> configuration is stripping the environment, so this doesn't work and I\n> still have to enter my git credentials.\n> \n> What environment variables do I need to configure sudo to preserve to\n> make sudo -E git pull work with my credential cache? Or is there\n> something else I can pass to git or define to get it to use my\n> credential cache?\n\nFrom \"git help credential-cache\":\n\n  --socket <path>\n    Use <path> to contact a running cache daemon (or start a new cache daemon if\n    one is not started).  Defaults to $XDG_CACHE_HOME/git/credential/socket\n    unless ~/.git-credential-cache/ exists in which case\n    ~/.git-credential-cache/socket is used instead. If your home directory is on\n    a network-mounted filesystem, you may need to change this to a local\n    filesystem. You must specify an absolute path.\n\nSo probably sudo is setting $HOME (even if using $XDG_CACHE_HOME, that defaults\nto $HOME/.cache).\n\nYou can specify arguments to a helper in your config file, like:\n\n  [credential]\n  helper = \"cache --socket /home/youruser/.git-credential-cache/socket\"\n\nwhich will make the location independent of $HOME.\n\nNote that it's a little funky to be accessing the cache as a different user than\nthe one who created it. This should work reliably when the cache was created by\nyour normal user, but then accessed as root, because root has permissions to\naccess the socket. But if you spawn a cache daemon as root (because the _first_\noperation you perform is as root, which automatically starts a daemon to store\nthe cached credential), then it's likely you won't be able to access it as your\nregular user.\n\n-Peff\n"},{"id":"419023","messageId":"YEwoyeYM7ac+6aIx@google.com","threadId":"55301","inReplyTo":"YEvPQS1+1sxd/aGw@coredump.intra.peff.net","subject":"Re: git credential cache and sudo","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2021-03-13T02:51:53Z","receivedAt":"2021-03-13T02:52:51Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Jeff King wrote:\n\n> Note that it's a little funky to be accessing the cache as a different user than\n> the one who created it. This should work reliably when the cache was created by\n> your normal user, but then accessed as root, because root has permissions to\n> access the socket. But if you spawn a cache daemon as root (because the _first_\n> operation you perform is as root, which automatically starts a daemon to store\n> the cached credential), then it's likely you won't be able to access it as your\n> regular user.\n\nI wonder if this suggests a missing feature in\ngit-credential-cache(1): if the manpage advertised a way to launch the\ndaemon through an explicit command, similar to 'ssh-agent', then a\nuser could run that as themselves before running other commands that\ncommunicate with it as another user.\n\nAll that said: John, why are you running git as root in the first\nplace?  It's likely that it's safer to run git as a different user and\nuse a separate command such as rsync to perform the privileged deploy\naction.\n\nThanks,\nJonathan\n"},{"id":"419175","messageId":"CAP8UukjOghB7yak-tk=+YvCDkgsMt7bobfrbdiRmPpus3LaZJA@mail.gmail.com","threadId":"55301","inReplyTo":"YEwoyeYM7ac+6aIx@google.com","subject":"Re: git credential cache and sudo","fromName":"John Ratliff","fromEmail":"john@technoplaza.net","sentAt":"2021-03-15T17:24:41Z","receivedAt":"2021-03-15T17:25:54Z","isPatch":false,"sender":{"key":"john@technoplaza.net","avatar":null},"body":"We have a shared git repo for our production puppet environment. I\nhave my own environment for testing things, so my git credential cache\nis already created as my user before I move things into production. My\nenvironment is in a github fork of the production environment though,\nso I don't think rsync is an option here. It's possible the directory\npermissions could be ACL'd to enable us not to need sudo, but I do not\nhave the authority to change that myself.\n\nI think I will try referencing the socket and see how that works.\n\nThanks.\n\n--John\n\nOn Fri, Mar 12, 2021 at 9:51 PM Jonathan Nieder <jrnieder@gmail.com> wrote:\n>\n> Jeff King wrote:\n>\n> > Note that it's a little funky to be accessing the cache as a different user than\n> > the one who created it. This should work reliably when the cache was created by\n> > your normal user, but then accessed as root, because root has permissions to\n> > access the socket. But if you spawn a cache daemon as root (because the _first_\n> > operation you perform is as root, which automatically starts a daemon to store\n> > the cached credential), then it's likely you won't be able to access it as your\n> > regular user.\n>\n> I wonder if this suggests a missing feature in\n> git-credential-cache(1): if the manpage advertised a way to launch the\n> daemon through an explicit command, similar to 'ssh-agent', then a\n> user could run that as themselves before running other commands that\n> communicate with it as another user.\n>\n> All that said: John, why are you running git as root in the first\n> place?  It's likely that it's safer to run git as a different user and\n> use a separate command such as rsync to perform the privileged deploy\n> action.\n>\n> Thanks,\n> Jonathan\n"},{"id":"419179","messageId":"YE+t6z6j2ITeqpnD@coredump.intra.peff.net","threadId":"55301","inReplyTo":"YEwoyeYM7ac+6aIx@google.com","subject":"Re: git credential cache and sudo","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2021-03-15T18:56:43Z","receivedAt":"2021-03-15T18:57:29Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Mar 12, 2021 at 06:51:53PM -0800, Jonathan Nieder wrote:\n\n> > Note that it's a little funky to be accessing the cache as a different user than\n> > the one who created it. This should work reliably when the cache was created by\n> > your normal user, but then accessed as root, because root has permissions to\n> > access the socket. But if you spawn a cache daemon as root (because the _first_\n> > operation you perform is as root, which automatically starts a daemon to store\n> > the cached credential), then it's likely you won't be able to access it as your\n> > regular user.\n> \n> I wonder if this suggests a missing feature in\n> git-credential-cache(1): if the manpage advertised a way to launch the\n> daemon through an explicit command, similar to 'ssh-agent', then a\n> user could run that as themselves before running other commands that\n> communicate with it as another user.\n\nPerhaps. The daemon side of the credential-cache helper does not work\nquite like ssh-agent, though, in that it tries to be ephemeral. So after\nstarting, you have 30 seconds to give it some data to cache before it\nwill exit. Normally this is fine since it's started by the client side\nof the helper, which will then immediately supply it with data.\n\nSo after starting it, you'd need to immediately prime it with data,\neither manually or by running a Git command. And then hope that command,\nincluding time to talk to the other side on the network and for you to\ntype your password, does not exceed the timeout.\n\n-Peff\n"}]}