git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Shared bare repository dubious ownership error after 2.40.1-r0

From
CSColin Stagner <ask@howdoi.land>
Date
Jul 18, 2024, 04:24 UTC
Message-ID
<984140ad-b2b9-4336-84db-552428071f7e@howdoi.land>
In-Reply-To
<dd703bdc-f485-4162-92a5-fd2828b69604@lodispoto.com>
Mike,
On 7/10/24 18:16, Mike Lodispoto wrote:
> | $ git pull
> | fatal: detected dubious ownership in repository at

This appears to be known behavior introduced as a fix for CVE-2024-32004. It appears that the safe.directory restrictions now apply to fetch and clone as well. See the release notes for v2.45.1 [1].

You can fix this by adding the path containing your repositories to the safe.directory configuration parameter as Git recommends. Whether or not you should is another matter—this can expose your devs to attacks from other user accounts.

I also have small workgroups that use NFS and other network filesystems to share repositories. Are there any plans to make cloning a local repository safe?

Colin
References
[1]: <https://lore.kernel.org/git/xmqqv83g4937.fsf@gitster.g/>
Previous: Mike LodispotoNext: Ben Zanin
Message 2 of 3 in “Shared bare repository dubious ownership error after 2.40.1-r0”
  1. Mike LodispotoJul 10, 2024
  2. Colin StagnerJul 18, 2024
  3. Ben ZaninJul 18, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.