Re: What's cooking in git.git (Apr 2022, #03; Tue, 12)

From: Philippe Blain <levraiphilippeblain@gmail.com>
Date: Apr 12, 2022, 17:52 UTC
Message-ID: <8698e468-5552-77a3-10c7-933affd98832@gmail.com>
In-Reply-To: <xmqq8rsab5do.fsf@gitster.g>

Hi Junio,

Le 2022-04-12 à 13:04, Junio C Hamano a écrit :

Show 8 quoted lines

> 
> 
> Security releases for the 2.30-2.35 maintenance tracks have been
> tagged to address CVE-2022-24765, which allows a user to trick other
> users into running a command of their choice easily on multi-user
> machines with a shared "mob" directory.  The fix has been also
> merged to Git 2.36-rc2 and to all integration branches.
>

This is quite a big behaviour change for some environments [1], so I would think maybe it deserves to be fully spelled out in the release notes for 2.36.0, instead of just referring readers to the release notes for the maintenance release, where they can read a full description only in the release notes for 2.30.3 ?

Thanks, Philippe.

[1] the commit message for the change mentions "shared directories", but in some environments, it is quite common for each user to have read access to other uers's home directories. I'm mostly thinking about high performance computing clusters, which is the kind of systems I have experience with. This makes it really easy for local "git experts" to 'cd' into a colleague's repo and help them when they are facing a Git problem. The fact that it won't be possible to do that without manually invoking 'git config --add safe.directory $PWD' beforehand is a little sad... What were the arguments for specifically disabling 'git -c safe.directory' for this fix ?