From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 23 Oct 2026 08:23:05 GMT
Subject: Re: [RFC/PATCH] config: honor file permission bits
Message-ID: <atsZX6exgGJkNQQQ@pks.im>
In-Reply-To: <xmqqbj8p7okv.fsf@gitster.g>

On Mon, Oct 19, 2026 at 07:27:28AM -0700, Junio C Hamano wrote:
> Because our updates to an existing file almost never makes
> modifications in place, and instead create a new "lockfile",
> propagate the permission bits from the original, copy the contents
> from the original file while tweaking the contents as needed, and
> then finally rename the lockfile to replace the original file, you
> cannot "protect" your .global configuration file from accidental
> clobbering by doing something like this:
> 
> 	$ chmod a-w $HOME/.gitconfig
> 
> Of course, if you make your $HOME directory unwritable, it may
> protect your .gitconfig from getting updated, but that goes totally
> against the intuition and is not how you would protect a regular
> file from getting overwritten.
> 
> Teach the configuration file writing machinery to inspect the
> permission bits of the original with access(2) and refrain from
> doing the usual "write a lockfile and replace the original with it"
> dance ourselves when we shouldn't be able to write it.

What I wonder is what makes our config file so special compared to
everything else that uses lockfiles. Or put differently: if we think
it's important to honor permissions bits (which I think is sensible),
shouldn't we do that in a central location like in "lockfile.c" so that
all users of this interface behave the same?

Patrick