Re: Git clone reads safe.directory differently?

From: Junio C Hamano <gitster@pobox.com>
Date: Jul 31, 2024, 16:23 UTC
Message-ID: <xmqqo76d7coa.fsf@gitster.g>
In-Reply-To: <20240731072832.GB595974@coredump.intra.peff.net>

Jeff King <peff@peff.net> writes:

> It could be that "clone" should try to avoid a "--local" clone from a
> repo with different ownership, if the local hardlink path is more
> dangerous. But that distinction is not something upload-pack even knows
> about, so the code would have to go into clone.

Sounds good.

Show 6 quoted lines

> And then upload-pack
> could be free to drop the ownership check. Certainly a lot of people
> have complained about it (I had actually thought we reverted it in
> v2.45.2, but that was just the extra hooks defense-in-depth; so again, I
> may be getting confused about the extra value of the enter_repo()
> ownership check that came at the same time).

As enter_repo() is about the protocol driver thing and not about normal users working inside a repository, calls to it appear only in receive-pack, upload-pack, upload-archive, http-backend, and daemon.

Among them, upload-pack is the only thing we promise that is safe to work even in a hostile repository? If we push into a repository over the local transport, we would trigger post-receive hook as ourselves, which we would probably not want. The same story goes for daemon, http-backend, and upload-archive.

So we probably need to add another axis to the "strict" parameter enter_repo() takes to selectively disable the ownership checks only for upload-pack, or something like that.

We may want to restrict "tar.<format>.command" only to protected configuration and then we may be able to loosen the ownership check for the upload-archive command.

Thanks.