freshlybakedca.ke / git
Git fork
fork atom

git-compat-util: allow root to access both SUDO_UID and root owned

Previous changes introduced a regression which will prevent root for
accessing repositories owned by thyself if using sudo because SUDO_UID
takes precedence.

Loosen that restriction by allowing root to access repositories owned
by both uid by default and without having to add a safe.directory
exception.

A previous workaround that was documented in the tests is no longer
needed so it has been removed together with its specially crafted
prerequisite.

Helped-by: Johanness Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

authored by

Carlo Marcelo Arenas Belón and committed by
Junio C Hamano 6b11e3d5 b9063afd

+11 -18
unified split
+4 -3
Documentation/config/safe.txt
··· 30 30 As explained, Git only allows you to access repositories owned by 31 31 yourself, i.e. the user who is running Git, by default. When Git 32 32 is running as 'root' in a non Windows platform that provides sudo, 33 - however, git checks the SUDO_UID environment variable that sudo creates 34 - and will allow access to the uid recorded as its value instead. 33 + however, git checks the SUDO_UID environment variable that sudo creates 34 + and will allow access to the uid recorded as its value in addition to 35 + the id from 'root'. 35 36 This is to make it easy to perform a common sequence during installation 36 37 "make && sudo make install". A git process running under 'sudo' runs as 37 38 'root' but the 'sudo' command exports the environment variable to record 38 39 which id the original user has. 39 40 If that is not what you would prefer and want git to only trust 40 - repositories that are owned by root instead, then you must remove 41 + repositories that are owned by root instead, then you can remove 41 42 the `SUDO_UID` variable from root's environment before invoking git.
+6 -1
git-compat-util.h
··· 447 447 448 448 euid = geteuid(); 449 449 if (euid == ROOT_UID) 450 - extract_id_from_env("SUDO_UID", &euid); 450 + { 451 + if (st.st_uid == ROOT_UID) 452 + return 1; 453 + else 454 + extract_id_from_env("SUDO_UID", &euid); 455 + } 451 456 452 457 return st.st_uid == euid; 453 458 }
+1 -14
t/t0034-root-safe-directory.sh
··· 68 68 ) 69 69 ' 70 70 71 - test_expect_failure SUDO 'can access with sudo if root' ' 71 + test_expect_success SUDO 'can access with sudo if root' ' 72 72 ( 73 73 cd root/p && 74 74 sudo git status ··· 82 82 unset SUDO_UID && 83 83 git status 84 84 END 85 - ) 86 - ' 87 - 88 - test_lazy_prereq SUDO_SUDO ' 89 - sudo sudo id -u >u && 90 - id -u root >r && 91 - test_cmp u r 92 - ' 93 - 94 - test_expect_success SUDO_SUDO 'can access with sudo abusing SUDO_UID' ' 95 - ( 96 - cd root/p && 97 - sudo sudo git status 98 85 ) 99 86 ' 100 87