Hi Everyone,
I've got a big DoS on my hands since safe directories landed on Fedora. I think this commit is the one responsible, but I may be mistaken: <https://github.com/git/git/commit/8959555cee7e>.
At this point I've wasted enough time on them. Now I would like to disable them completely.
How do I disable the safe directory changes?
Thanks in advance,
Jeff
Re: How to disable safe directories?
On 2024-05-21 10:39:32, Jeffrey Walton wrote:
> Hi Everyone, > > I've got a big DoS on my hands since safe directories landed on > Fedora. I think this commit is the one responsible, but I may be > mistaken: <https://github.com/git/git/commit/8959555cee7e>. > > At this point I've wasted enough time on them. Now I would like to > disable them completely. > > How do I disable the safe directory changes? >
That is actually pretty easy: Kick out the commit. I would suggest to turn the die() into a warning(), though, giving people time to adopt this restriction.
Regards
Harri
Re: How to disable safe directories?
On Tue, May 21, 2024 at 6:42 AM Harald Dunkel <harald.dunkel@aixigo.com> wrote:
> > On 2024-05-21 10:39:32, Jeffrey Walton wrote: > > Hi Everyone, > > > > I've got a big DoS on my hands since safe directories landed on > > Fedora. I think this commit is the one responsible, but I may be > > mistaken: <https://github.com/git/git/commit/8959555cee7e>. > > > > At this point I've wasted enough time on them. Now I would like to > > disable them completely. > > > > How do I disable the safe directory changes? > > > > That is actually pretty easy: Kick out the commit. I would suggest > to turn the die() into a warning(), though, giving people time to > adopt this restriction.
Thanks Harri.
Would that be something like safe_directories.enabled = false? If not, can you point to a setting?
Jeff
Re: How to disable safe directories?
On 2024-05-21 12:45:18, Jeffrey Walton wrote:
> > Thanks Harri. > > Would that be something like safe_directories.enabled = false? If not, > can you point to a setting? >
It is possible to disable this feature globally using something like
git config --system --add safe.directory /somepath/.git
Some say even
git config --system --add safe.directory '*'
works, but I haven't tried that.
Regards
Harri
Re: How to disable safe directories?
On Tue, May 21, 2024 at 10:25 AM Harald Dunkel <harald.dunkel@aixigo.com> wrote:
> > On 2024-05-21 12:45:18, Jeffrey Walton wrote: > > > > Thanks Harri. > > > > Would that be something like safe_directories.enabled = false? If not, > > can you point to a setting? > > > > It is possible to disable this feature globally using something > like > > git config --system --add safe.directory /somepath/.git > > Some say even > > git config --system --add safe.directory '*' > > works, but I haven't tried that.
Thanks Harri.
Yeah, that did not work for me, either.
I've been through directory permissions on the workstations and servers, and the SELinux contexts on the server. I cannot find anything wrong with them. Do you know how to have git tell us what the actual problem is? `git -v pull` is not providing more information, like what the actual problem is (it just barfs).
Thanks again.
Jeff
Re: How to disable safe directories?
On 2024-05-21 16:25:17, Harald Dunkel wrote:
> > It is possible to disable this feature globally using something > like > > git config --system --add safe.directory /somepath/.git >
PS: Its obvious that each peer running git can verify only local directories for dubious access bits. Working with shared remote repositories you have to consider setting the safe.directory option on the remote server.
Since CVE-2024-32004 assumes an attacker running its own repository, I just wonder why he should use the most recent, fixed git version?
Regards Harri