Re: [PATCH v4 2/5] Documentation: define protected configuration

From: Jonathan Tan <jonathantanmy@google.com>
Date: Jun 22, 2022, 21:58 UTC
Message-ID: <20220622215848.3733308-1-jonathantanmy@google.com>
In-Reply-To: <a5a1dcb03e18f3b9f3fd77ef94c17a05763a5f13.1654635432.git.gitgitgadget@gmail.com>

"Glen Choo via GitGitGadget" <gitgitgadget@gmail.com> writes:

> From: Glen Choo <chooglen@google.com>
> 
> For security reasons, there are config variables that are only trusted
> when they are specified in extra-trustworthy configuration scopes, which

Probably better to delete "extra-trustworthy", or at least "extra-" - it's better to explain why and how they're trustworthy, which you have already done in the commit message.

> diff --git a/Documentation/git-config.txt b/Documentation/git-config.txt
> index 5e4c95f2423..2b4334faec9 100644
> --- a/Documentation/git-config.txt
> +++ b/Documentation/git-config.txt

[snip]

Show 8 quoted lines

> +Protected config refers to the 'system', 'global', and 'command' scopes. Git
> +considers these scopes to be especially trustworthy because they are likely
> +to be controlled by the user or a trusted administrator. An attacker who
> +controls these scopes can do substantial harm without using Git, so it is
> +assumed that the user's environment protects these scopes against attackers.
> +
> +For security reasons, certain options are only respected when they are
> +specified in protected config, and ignored otherwise.

Also "especially trustworthy" here.