bdc77d1d685 (Add a function to determine whether a path is owned by the
current user, 2022-03-02) checks for the effective uid of the running
process using geteuid() but didn't account for cases where that uid was
root (because git was invoked through sudo or doas) and the effetive id
that repositiry trusted for its config was different, therefore failing
the following common call:
guy@renard ~/Software/uncrustify $ sudo git describe --always --dirty
[sudo] password for guy:
fatal: unsafe repository ('/home/guy/Software/uncrustify' is owned by someone else)
Attempt to detect those cases by using the environment variables that
those tools create to keep track of the original user id, and do the
ownership check using those instead.
This assumes the environment the user is running with after going
priviledged can't be tampered with, and also does the check only for
root to keep the most common case less complicated, but as a side effect
will miss cases where sudo (or an equivalent) was used to change to
another unpriviledged user.
Reported-by: Guy Maurel <guy.j@xxxxxxxxx>
Helped-by: SZEDER Gábor <szeder.dev@xxxxxxxxx>
Helped-by: Randall Becker <rsbecker@xxxxxxxxxxxxx>
Suggested-by: Johannes Schindelin <Johannes.Schindelin@xxxxxx>
Signed-off-by: Carlo Marcelo Arenas Belón <carenas@xxxxxxxxx>
---
Sent as an RFC as it has been only lightly tested and because some of
the assumptions I have to make, made me unconfortable.
Ex, in order to make the atoi() calls safe, I was originally doing
is_digit(), but that would require this function to move further down
to work.
It is also now big enough that would make sense for it to move into
its own compat file and outside for git-compat-util.h, but if that is
done we might not keep the "root uid is not always 0" bits that seem
useful to have for the future.
getent() is not thread safe, so it might be worth to use an alternative
but that would require a bigger change.
IMHO it should have a test added, but not sure where it would fit.
Original discussion in :
https://lore.kernel.org/git/4ef9287b-6260-9538-7c89-cffb611520ee@xxxxxxxxx/
git-compat-util.h | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/git-compat-util.h b/git-compat-util.h
index 58fd813bd01..2ed97b47979 100644
--- a/git-compat-util.h
+++ b/git-compat-util.h
@@ -437,12 +437,34 @@ static inline int git_offset_1st_component(const char *path)
#endif
#ifndef is_path_owned_by_current_user
+
+#ifdef __TANDEM
+#define ROOT_UID 65535
+#else
+#define ROOT_UID 0
+#endif
+
static inline int is_path_owned_by_current_uid(const char *path)
{
struct stat st;
+ uid_t euid;
+
if (lstat(path, &st))
return 0;
- return st.st_uid == geteuid();
+
+ euid = geteuid();
+ if (euid == ROOT_UID) {
+ /* we might have raised our priviledges with sudo or doas */
+ const char *real_uid = getenv("SUDO_UID");
+ if (real_uid && *real_uid)
+ euid = atoi(real_uid);
+ else {
+ real_uid = getenv("DOAS_UID");
+ if (real_uid && *real_uid)
+ euid = atoi(real_uid);
+ }
+ }
+ return st.st_uid == euid;
}
#define is_path_owned_by_current_user is_path_owned_by_current_uid
--
2.36.0.266.g59f845bde02
