From: Phillip Wood <phillip.wood123@gmail.com>
Date: Wed, 26 Jun 2024 15:26:15 GMT
Subject: Re: [PATCH] setup: support GIT_IGNORE_INSECURE_OWNER environment variable
Message-ID: <72e42e9f-5b85-4863-8506-c99d658d7596@gmail.com>
In-Reply-To: <9e5b0cc6-e28c-4c51-ab48-663c61c00ee3@gmail.com>

On 26/06/2024 14:11, Phillip Wood wrote:
> Hi Florian
> 
> On 26/06/2024 13:33, Florian Schmaus wrote:
>> Sometimes more flexibility to disable/ignore the ownership check, besides
>> the safe.directory configuration option, is required.
>>
>> For example, git-daemon running as nobody user, which typically has no
>> home directory. Therefore, we can not add the path to a user-global
>> configuration and adding the path to the system-wide configuration could
>> have negative security implications.
>>
>> Therefore, make the check configurable via an environment variable.
> 
> An alternative would be to allow safe.directory to be specified on the 
> command line with "git -c safe.directory='*' daemon ..." rather than 
> adding a dedicated environment variable.

To expand an this a little - a couple of times I've wanted to checkout a 
bare repository that is owned by a different user. It is a pain to have 
to add a new config setting just for a one-off checkout. Being able to 
adjust the config on the command line would be very useful in that case.

> Or you could set $HOME to a 
> suitable directory when running "git daemon" and put the user-global 
> config file there. That directory and config file only need to be 
> readable by the user that "git daemon" is running under it can be owned 
> by root or whoever else you want.

The advantage of this approach is that there are no changes needed to 
git, instead of setting GIT_IGNORE_INSECURE_OWNER one sets HOME to point 
to a suitable config file. I found this useful when I was debugging the 
issues with git-daemon earlier[1]

Best Wishes

Phillip

[1] 
https://lore.kernel.org/git/834862fd-b579-438a-b9b3-5246bf27ce8a@gmail.com


> Best Wishes
> 
> Phillip
> 
> 
>> If the environment variable GIT_IGNORE_INSECURE_OWNER is set to true,
>> then ignore potentially insecure ownership of git-related path
>> components.
>>
>> Signed-off-by: Florian Schmaus <flo@geekplace.eu>
>> ---
>>   setup.c | 8 ++++++++
>>   1 file changed, 8 insertions(+)
>>
>> diff --git a/setup.c b/setup.c
>> index 3afa6fb09b28..da3f504fb536 100644
>> --- a/setup.c
>> +++ b/setup.c
>> @@ -1278,6 +1278,14 @@ static int ensure_valid_ownership(const char 
>> *gitfile,
>>        */
>>       git_protected_config(safe_directory_cb, &data);
>> +    if (data.is_safe)
>> +        return data.is_safe;
>> +
>> +    if (git_env_bool("GIT_IGNORE_INSECURE_OWNER", 0)) {
>> +        warning("ignoring dubious ownership in repository at '%s' 
>> (GIT_IGNORE_INSECURE_OWNER set)", data.path);
>> +        return 1;
>> +    }
>> +
>>       return data.is_safe;
>>   }
> 
>