From: John Soo <johh.soo@arista.com>
Date: Wed, 02 Nov 2022 15:18:25 GMT
Subject: safe.directory and ACLs
Message-ID: <CAJyRyRo7oVAfLx8MONO=Y8KhLvL+tJgDTbCUezR1AFa73R5pbw@mail.gmail.com>

Hello git!

We have some build processes that would like access to repos in /home
directories that are 0700. We had done this already:

$ setfacl --recursive --modify group:<build users
group>:r-X,default:group:<build users group>:r-X /home

Should this ACL be enough to consider the repos "owned" by the build
users? Should *any* ACL be enough to consider the repos "owned" by the
build users?

Currently:
$ sudo -u <build user> git config --get safe.directory
$ sudo -u <build user> git -C /home/<non build user>/repo rev-parse HEAD
fatal: unsafe repository ('/home/<non build user>/repo' is owned by
someone else)
To add an exception for this directory, call:

        git config --global --add safe.directory /home/<non build user>

Kindly,

John Soo