git/list[1] front-page[2] threads[3] people[4] search[5] about
 

safe.directory warnings for root-owned repositories

From
MOMichael Orlitzky <michael@orlitzky.com>
Date
Oct 31, 2024, 04:23 UTC
Message-ID
<ZyMGKHTnZDQ5JVuo@mertle>
If I create a new repository as root,
  $ sudo git init
  Initialized empty Git repository in /home/mjo/tmp/.git/
  $ ls -alh
  total 12K
  drwxr-xr-x  3 mjo  mjo  4.0K 2024-10-31 00:09 .
  drwxr-x--- 17 mjo  mjo  4.0K 2024-10-31 00:07 ..
  drwxr-xr-x  6 root root 4.0K 2024-10-31 00:09 .git
and attempt to do anything in it, I get a safe.directory warning:
  $ git status
  fatal: detected dubious ownership in repository at '/home/mjo/tmp'
  ...

Does that make sense? In terms of ownership, root:root is as safe as it gets.

I'm aware that safe.directory is only scratching the surface of these "doing things in a directory that someone else can write to" exploits, but within the limited scope of this one feature, root ownership does not strike me as particularly dubious.

Next: Caleb White
Message 1 of 4 in “safe.directory warnings for root-owned repositories”
  1. Michael OrlitzkyOct 31, 2024
  2. Caleb WhiteOct 31, 2024
  3. Michael OrlitzkyOct 31, 2024
  4. Taylor BlauOct 31, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.