If I create a new repository as root, $ sudo git init Initialized empty Git repository in /home/mjo/tmp/.git/ $ ls -alh total 12K drwxr-xr-x 3 mjo mjo 4.0K 2024-10-31 00:09 . drwxr-x--- 17 mjo mjo 4.0K 2024-10-31 00:07 .. drwxr-xr-x 6 root root 4.0K 2024-10-31 00:09 .git and attempt to do anything in it, I get a safe.directory warning: $ git status fatal: detected dubious ownership in repository at '/home/mjo/tmp' ... Does that make sense? In terms of ownership, root:root is as safe as it gets. I'm aware that safe.directory is only scratching the surface of these "doing things in a directory that someone else can write to" exploits, but within the limited scope of this one feature, root ownership does not strike me as particularly dubious.
