Re: [PATCH] setup: support GIT_IGNORE_INSECURE_OWNER environment variable
- From
- Phillip Wood <phillip.wood123@gmail.com>
- Date
- Jun 26, 2024, 15:26 UTC
- Message-ID
- <72e42e9f-5b85-4863-8506-c99d658d7596@gmail.com>
- In-Reply-To
- <9e5b0cc6-e28c-4c51-ab48-663c61c00ee3@gmail.com>
On 26/06/2024 14:11, Phillip Wood wrote:
Show 16 quoted lines
> Hi Florian > > On 26/06/2024 13:33, Florian Schmaus wrote: >> Sometimes more flexibility to disable/ignore the ownership check, besides >> the safe.directory configuration option, is required. >> >> For example, git-daemon running as nobody user, which typically has no >> home directory. Therefore, we can not add the path to a user-global >> configuration and adding the path to the system-wide configuration could >> have negative security implications. >> >> Therefore, make the check configurable via an environment variable. > > An alternative would be to allow safe.directory to be specified on the > command line with "git -c safe.directory='*' daemon ..." rather than > adding a dedicated environment variable.
To expand an this a little - a couple of times I've wanted to checkout a bare repository that is owned by a different user. It is a pain to have to add a new config setting just for a one-off checkout. Being able to adjust the config on the command line would be very useful in that case.
Show 5 quoted lines
> Or you could set $HOME to a > suitable directory when running "git daemon" and put the user-global > config file there. That directory and config file only need to be > readable by the user that "git daemon" is running under it can be owned > by root or whoever else you want.
The advantage of this approach is that there are no changes needed to git, instead of setting GIT_IGNORE_INSECURE_OWNER one sets HOME to point to a suitable config file. I found this useful when I was debugging the issues with git-daemon earlier[1]
Best Wishes
Phillip
[1] https://lore.kernel.org/git/834862fd-b579-438a-b9b3-5246bf27ce8a@gmail.com
Show 35 quoted lines
> Best Wishes
>
> Phillip
>
>
>> If the environment variable GIT_IGNORE_INSECURE_OWNER is set to true,
>> then ignore potentially insecure ownership of git-related path
>> components.
>>
>> Signed-off-by: Florian Schmaus <flo@geekplace.eu>
>> ---
>> setup.c | 8 ++++++++
>> 1 file changed, 8 insertions(+)
>>
>> diff --git a/setup.c b/setup.c
>> index 3afa6fb09b28..da3f504fb536 100644
>> --- a/setup.c
>> +++ b/setup.c
>> @@ -1278,6 +1278,14 @@ static int ensure_valid_ownership(const char
>> *gitfile,
>> */
>> git_protected_config(safe_directory_cb, &data);
>> + if (data.is_safe)
>> + return data.is_safe;
>> +
>> + if (git_env_bool("GIT_IGNORE_INSECURE_OWNER", 0)) {
>> + warning("ignoring dubious ownership in repository at '%s'
>> (GIT_IGNORE_INSECURE_OWNER set)", data.path);
>> + return 1;
>> + }
>> +
>> return data.is_safe;
>> }
>
>