{"thread":{"id":"58736","subject":"safe.directory and ACLs","startedAt":"2022-11-02T15:19:01Z","lastAt":"2022-11-03T00:39:33Z","messageCount":5,"participants":["John Soo","brian m. carlson","Taylor Blau"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"466318","messageId":"CAJyRyRo7oVAfLx8MONO=Y8KhLvL+tJgDTbCUezR1AFa73R5pbw@mail.gmail.com","threadId":"58736","inReplyTo":null,"subject":"safe.directory and ACLs","fromName":"John Soo","fromEmail":"johh.soo@arista.com","sentAt":"2022-11-02T15:18:25Z","receivedAt":"2022-11-02T15:19:01Z","isPatch":false,"sender":{"key":"johh.soo@arista.com","avatar":null},"body":"Hello git!\n\nWe have some build processes that would like access to repos in /home\ndirectories that are 0700. We had done this already:\n\n$ setfacl --recursive --modify group:<build users\ngroup>:r-X,default:group:<build users group>:r-X /home\n\nShould this ACL be enough to consider the repos \"owned\" by the build\nusers? Should *any* ACL be enough to consider the repos \"owned\" by the\nbuild users?\n\nCurrently:\n$ sudo -u <build user> git config --get safe.directory\n$ sudo -u <build user> git -C /home/<non build user>/repo rev-parse HEAD\nfatal: unsafe repository ('/home/<non build user>/repo' is owned by\nsomeone else)\nTo add an exception for this directory, call:\n\n        git config --global --add safe.directory /home/<non build user>\n\nKindly,\n\nJohn Soo\n"},{"id":"466331","messageId":"Y2LgzmTvElmRTsoe@tapette.crustytoothpaste.net","threadId":"58736","inReplyTo":"CAJyRyRo7oVAfLx8MONO=Y8KhLvL+tJgDTbCUezR1AFa73R5pbw@mail.gmail.com","subject":"Re: safe.directory and ACLs","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2022-11-02T21:27:42Z","receivedAt":"2022-11-02T21:28:12Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2022-11-02 at 15:18:25, John Soo wrote:\n> Hello git!\n> \n> We have some build processes that would like access to repos in /home\n> directories that are 0700. We had done this already:\n> \n> $ setfacl --recursive --modify group:<build users\n> group>:r-X,default:group:<build users group>:r-X /home\n> \n> Should this ACL be enough to consider the repos \"owned\" by the build\n> users? Should *any* ACL be enough to consider the repos \"owned\" by the\n> build users?\n> \n> Currently:\n> $ sudo -u <build user> git config --get safe.directory\n> $ sudo -u <build user> git -C /home/<non build user>/repo rev-parse HEAD\n> fatal: unsafe repository ('/home/<non build user>/repo' is owned by\n> someone else)\n> To add an exception for this directory, call:\n> \n>         git config --global --add safe.directory /home/<non build user>\n\nNo, the permissions of a repository, whether standard Unix permissions\nor ACLs, are not relevant to ownership.  The question here is whether\nthe owner of the .git directory (that is, the value of the `st_uid`\nfield when calling lstat(2) on it) is equal to the effective user ID.\n\nWhen you the path in `ls`, you can see the owner and group of the file\nspecified, and that owner is what matters here.\n-- \nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"},{"id":"466355","messageId":"CAJyRyRqMPX93-Oa5XMvZtDTRxh0SisUhOFAWhv-6hXR5sEkQpA@mail.gmail.com","threadId":"58736","inReplyTo":"Y2LgzmTvElmRTsoe@tapette.crustytoothpaste.net","subject":"Re: safe.directory and ACLs","fromName":"John Soo","fromEmail":"johh.soo@arista.com","sentAt":"2022-11-02T23:41:15Z","receivedAt":"2022-11-02T23:45:02Z","isPatch":false,"sender":{"key":"johh.soo@arista.com","avatar":null},"body":"Hi brian!\n\n> No, the permissions of a repository, whether standard Unix permissions\n> or ACLs, are not relevant to ownership.  The question here is whether\n> the owner of the .git directory (that is, the value of the `st_uid`\n> field when calling lstat(2) on it) is equal to the effective user ID.\n>\n> When you the path in `ls`, you can see the owner and group of the file\n> specified, and that owner is what matters here.\n\nI see. Is that by design or an implementation detail?\n\nKindly,\n\nJohn\n"},{"id":"466359","messageId":"Y2MHNeSrhxfH1Ayf@nand.local","threadId":"58736","inReplyTo":"CAJyRyRqMPX93-Oa5XMvZtDTRxh0SisUhOFAWhv-6hXR5sEkQpA@mail.gmail.com","subject":"Re: safe.directory and ACLs","fromName":"Taylor Blau","fromEmail":"me@ttaylorr.com","sentAt":"2022-11-03T00:11:33Z","receivedAt":"2022-11-03T00:11:39Z","isPatch":false,"sender":{"key":"me@ttaylorr.com","avatar":"https://avatars.githubusercontent.com/u/301000140?v=4"},"body":"On Wed, Nov 02, 2022 at 04:41:15PM -0700, John Soo wrote:\n> Hi brian!\n>\n> > No, the permissions of a repository, whether standard Unix permissions\n> > or ACLs, are not relevant to ownership.  The question here is whether\n> > the owner of the .git directory (that is, the value of the `st_uid`\n> > field when calling lstat(2) on it) is equal to the effective user ID.\n> >\n> > When you the path in `ls`, you can see the owner and group of the file\n> > specified, and that owner is what matters here.\n>\n> I see. Is that by design or an implementation detail?\n\nIt is by design. See 8959555cee7 (setup_git_directory(): add an owner\ncheck for the top-level directory, 2022-03-02) for details.\n\nThanks,\nTaylor\n"},{"id":"466365","messageId":"CAJyRyRphLTHZ6pUqsq0F+X_9=ejcTByr5KvRSuMBn2DA5d2EMw@mail.gmail.com","threadId":"58736","inReplyTo":"Y2MHNeSrhxfH1Ayf@nand.local","subject":"Re: safe.directory and ACLs","fromName":"John Soo","fromEmail":"johh.soo@arista.com","sentAt":"2022-11-03T00:39:18Z","receivedAt":"2022-11-03T00:39:33Z","isPatch":false,"sender":{"key":"johh.soo@arista.com","avatar":null},"body":"Thank you!\n\nGot it!\n\nKindly,\n\nJohn\n"}]}