diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2022-03-02 12:23:04 +0100 |
|---|---|---|
| committer | Johannes Schindelin <johannes.schindelin@gmx.de> | 2022-03-21 13:16:26 +0100 |
| commit | 8959555cee7ec045958f9b6dd62e541affb7e7d9 (patch) | |
| tree | da189c139989e8ea73421bde49a076ae9508661b /Documentation/config.txt | |
| parent | bdc77d1d685be9c10b88abb281a42bc620548595 (diff) | |
| download | git-8959555cee7ec045958f9b6dd62e541affb7e7d9.tar.gz | |
setup_git_directory(): add an owner check for the top-level directory
It poses a security risk to search for a git directory outside of the
directories owned by the current user.
For example, it is common e.g. in computer pools of educational
institutes to have a "scratch" space: a mounted disk with plenty of
space that is regularly swiped where any authenticated user can create
a directory to do their work. Merely navigating to such a space with a
Git-enabled `PS1` when there is a maliciously-crafted `/scratch/.git/`
can lead to a compromised account.
The same holds true in multi-user setups running Windows, as `C:\` is
writable to every authenticated user by default.
To plug this vulnerability, we stop Git from accepting top-level
directories owned by someone other than the current user. We avoid
looking at the ownership of each and every directories between the
current and the top-level one (if there are any between) to avoid
introducing a performance bottleneck.
This new default behavior is obviously incompatible with the concept of
shared repositories, where we expect the top-level directory to be owned
by only one of its legitimate users. To re-enable that use case, we add
support for adding exceptions from the new default behavior via the
config setting `safe.directory`.
The `safe.directory` config setting is only respected in the system and
global configs, not from repository configs or via the command-line, and
can have multiple values to allow for multiple shared repositories.
We are particularly careful to provide a helpful message to any user
trying to use a shared repository.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Diffstat (limited to 'Documentation/config.txt')
| -rw-r--r-- | Documentation/config.txt | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Documentation/config.txt b/Documentation/config.txt index 6ba50b1104..34e6d477d6 100644 --- a/Documentation/config.txt +++ b/Documentation/config.txt @@ -438,6 +438,8 @@ include::config/rerere.txt[] include::config/reset.txt[] +include::config/safe.txt[] + include::config/sendemail.txt[] include::config/sequencer.txt[] |