# How to disable safe directories? 6 messages from 2024-05-21 to 2024-05-21. Participants: Jeffrey Walton, Harald Dunkel. Thread: https://gitlist.dev/t/61522 ## Jeffrey Walton, 2024-05-21 08:39 Subject: How to disable safe directories? Message-ID: URL: https://gitlist.dev/e/CAH8yC8mPP_2jv8HDBdMxWv6TbiLXeDnD%3DKmNRMbno2bHQtfH1A%40mail.gmail.com ``` Hi Everyone, I've got a big DoS on my hands since safe directories landed on Fedora. I think this commit is the one responsible, but I may be mistaken: . At this point I've wasted enough time on them. Now I would like to disable them completely. How do I disable the safe directory changes? Thanks in advance, Jeff ``` ## Harald Dunkel, 2024-05-21 10:42 Subject: Re: How to disable safe directories? Message-ID: <3e4a7071-60b0-4f7a-b347-d584d5eb076e@aixigo.com> URL: https://gitlist.dev/e/3e4a7071-60b0-4f7a-b347-d584d5eb076e%40aixigo.com In-Reply-To: ``` On 2024-05-21 10:39:32, Jeffrey Walton wrote: > Hi Everyone, > > I've got a big DoS on my hands since safe directories landed on > Fedora. I think this commit is the one responsible, but I may be > mistaken: . > > At this point I've wasted enough time on them. Now I would like to > disable them completely. > > How do I disable the safe directory changes? > That is actually pretty easy: Kick out the commit. I would suggest to turn the die() into a warning(), though, giving people time to adopt this restriction. Regards Harri ``` ## Jeffrey Walton, 2024-05-21 10:45 Subject: Re: How to disable safe directories? Message-ID: URL: https://gitlist.dev/e/CAH8yC8mNns_XiQHp3%3Dq_tYr03Q%2BkR1r%3D2WOYha1XMp%2BcYs9WDQ%40mail.gmail.com In-Reply-To: <3e4a7071-60b0-4f7a-b347-d584d5eb076e@aixigo.com> ``` On Tue, May 21, 2024 at 6:42 AM Harald Dunkel wrote: > > On 2024-05-21 10:39:32, Jeffrey Walton wrote: > > Hi Everyone, > > > > I've got a big DoS on my hands since safe directories landed on > > Fedora. I think this commit is the one responsible, but I may be > > mistaken: . > > > > At this point I've wasted enough time on them. Now I would like to > > disable them completely. > > > > How do I disable the safe directory changes? > > > > That is actually pretty easy: Kick out the commit. I would suggest > to turn the die() into a warning(), though, giving people time to > adopt this restriction. Thanks Harri. Would that be something like safe_directories.enabled = false? If not, can you point to a setting? Jeff ``` ## Harald Dunkel, 2024-05-21 14:25 Subject: Re: How to disable safe directories? Message-ID: URL: https://gitlist.dev/e/d71c7dff-46a7-4ac8-a8c7-ab4985458071%40aixigo.com In-Reply-To: ``` On 2024-05-21 12:45:18, Jeffrey Walton wrote: > > Thanks Harri. > > Would that be something like safe_directories.enabled = false? If not, > can you point to a setting? > It is possible to disable this feature globally using something like git config --system --add safe.directory /somepath/.git Some say even git config --system --add safe.directory '*' works, but I haven't tried that. Regards Harri ``` ## Jeffrey Walton, 2024-05-21 14:40 Subject: Re: How to disable safe directories? Message-ID: URL: https://gitlist.dev/e/CAH8yC8nqRSmxHp%2B9fdPNh29eLv4JZ2%2BNFnYtOejhf-F%2Bn7jkCw%40mail.gmail.com In-Reply-To: ``` On Tue, May 21, 2024 at 10:25 AM Harald Dunkel wrote: > > On 2024-05-21 12:45:18, Jeffrey Walton wrote: > > > > Thanks Harri. > > > > Would that be something like safe_directories.enabled = false? If not, > > can you point to a setting? > > > > It is possible to disable this feature globally using something > like > > git config --system --add safe.directory /somepath/.git > > Some say even > > git config --system --add safe.directory '*' > > works, but I haven't tried that. Thanks Harri. Yeah, that did not work for me, either. I've been through directory permissions on the workstations and servers, and the SELinux contexts on the server. I cannot find anything wrong with them. Do you know how to have git tell us what the actual problem is? `git -v pull` is not providing more information, like what the actual problem is (it just barfs). Thanks again. Jeff ``` ## Harald Dunkel, 2024-05-21 14:49 Subject: Re: How to disable safe directories? Message-ID: <98381fb2-5110-4e7f-a504-c5ff75dcd050@aixigo.com> URL: https://gitlist.dev/e/98381fb2-5110-4e7f-a504-c5ff75dcd050%40aixigo.com In-Reply-To: ``` On 2024-05-21 16:25:17, Harald Dunkel wrote: > > It is possible to disable this feature globally using something > like > > git config --system --add safe.directory /somepath/.git > PS: Its obvious that each peer running git can verify only local directories for dubious access bits. Working with shared remote repositories you have to consider setting the safe.directory option on the remote server. Since CVE-2024-32004 assumes an attacker running its own repository, I just wonder why he should use the most recent, fixed git version? Regards Harri ```