Re: regression: "96b9e0e3 config: treat user and xdg config permission problems as errors" busted git-daemon

From: Jeff King <peff@peff.net>
Date: Apr 12, 2013, 19:01 UTC
Message-ID: <20130412190152.GB4108@sigill.intra.peff.net>
In-Reply-To: <7vbo9jehfx.fsf@alter.siamese.dyndns.org>

On Fri, Apr 12, 2013 at 11:23:46AM -0700, Junio C Hamano wrote:

Show 19 quoted lines

> Jeff King <peff@peff.net> writes:
> 
> > So here's what I came up with. I tried to make the exception as tight as
> > possible by checking that $HOME was actually the problem, as that is the
> > common problem (you switch users, but HOME is pointing to the old user).
> > ...
> > diff --git a/daemon.c b/daemon.c
> > index 131b049..6c56cc0 100644
> > --- a/daemon.c
> > +++ b/daemon.c
> > @@ -1091,7 +1091,7 @@ static void drop_privileges(struct credentials *cred)
> >  	if (cred && (initgroups(cred->pass->pw_name, cred->gid) ||
> >  	    setgid (cred->gid) || setuid(cred->pass->pw_uid)))
> >  		die("cannot drop privileges");
> > -	setenv("GIT_CONFIG_INACCESSIBLE_HOME_OK", "1", 0);
> > +	setenv(GIT_INACCESSIBLE_HOME_OK_ENVIRONMENT, "1", 0);
> >  }
> 
> Compared against an unpublished diffbase???

Oops. Forgot I had made a WIP commit before running the diff.

Show 8 quoted lines

> OK, so the idea is
> 
>  - The environment can tell us to ignore permission errors for paths
>    under $HOME if (and only if) $HOME itself is not readable;
> 
>  - We got a permission error here.  inaccessible_home_ok() will tell
>    us if the path is under $HOME and the above condition holds (in
>    which case it will say "ok, ignore that error").

Exactly.

> which sounds good, but it relies on the caller of this function not
> to try actually reading from the path.

Yes, but that is the only sane thing for the caller to do, since it gets the same exit code from ENOENT and ENOTDIR already. Probably a comment describing the return value is in order.

Show 5 quoted lines

> If the access() failed due to ENOENT, the caller will get a negative
> return from this function and will treat it as "ok, it does not
> exist", with the original or the updated code.  This new case is
> treated the same way by the existing callers, i.e. pretending as if
> there is _no_ file in that unreadable $HOME directory.

Exactly.

> That semantics sounds sane and safe to me.

Thanks. I'll re-roll with a proper commit message and the fixups I mentioned above. I think we should still do the documentation for git-daemon. But it is no longer about "oops, we broke git-daemon", but "you may want know that we do not set HOME in case you are doing something tricky with config". I'll submit that with the re-roll, too.

Do you have an opinion on just dropping the environment variable completely and behaving this way all the time? It would "just fix" the cases people running into using su/sudo, too.

-Peff