git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: git credential cache and sudo

From
Jonathan Nieder <jrnieder@gmail.com>
Date
Mar 13, 2021, 02:51 UTC
Message-ID
<YEwoyeYM7ac+6aIx@google.com>
In-Reply-To
<YEvPQS1+1sxd/aGw@coredump.intra.peff.net>
Jeff King wrote:
Show 7 quoted lines
> Note that it's a little funky to be accessing the cache as a different user than
> the one who created it. This should work reliably when the cache was created by
> your normal user, but then accessed as root, because root has permissions to
> access the socket. But if you spawn a cache daemon as root (because the _first_
> operation you perform is as root, which automatically starts a daemon to store
> the cached credential), then it's likely you won't be able to access it as your
> regular user.

I wonder if this suggests a missing feature in git-credential-cache(1): if the manpage advertised a way to launch the daemon through an explicit command, similar to 'ssh-agent', then a user could run that as themselves before running other commands that communicate with it as another user.

All that said: John, why are you running git as root in the first place? It's likely that it's safer to run git as a different user and use a separate command such as rsync to perform the privileged deploy action.

Thanks, Jonathan

Previous: Jeff KingNext: John Ratliff
Message 3 of 5 in “git credential cache and sudo”
  1. John RatliffMar 12, 2021
  2. Jeff KingMar 12, 2021
  3. Jonathan NiederMar 13, 2021
  4. John RatliffMar 15, 2021
  5. Jeff KingMar 15, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.