| Message ID | 20220427222649.63516-1-carenas@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [RFC,v2] git-compat-util: avoid failing dir ownership checks if running privileged | expand |
Carlo Marcelo Arenas Belón <carenas@gmail.com> writes: > diff --git a/git-compat-util.h b/git-compat-util.h > index 58fd813bd01..3c9883934f6 100644 > --- a/git-compat-util.h > +++ b/git-compat-util.h > @@ -437,12 +437,50 @@ static inline int git_offset_1st_component(const char *path) > #endif > > #ifndef is_path_owned_by_current_user > + > +#ifdef __TANDEM > +#define ROOT_UID 65535 > +#else > +#define ROOT_UID 0 > +#endif > + > +/* > + * this helper function overrides a ROOT_UID with the one provided by > + * an environment variable, do not use unless the original user is > + * root > + */ > +static inline void extract_id_from_env(const char *env, uid_t *id) > +{ > + const char *real_uid = getenv(env); > + > + /* discard any empty values */ > + if (real_uid && *real_uid) { > + char *endptr; > + unsigned long env_id; > + int saved_errno = errno; > + > + errno = 0; > + env_id = strtoul(real_uid, &endptr, 10); > + if (!errno && !*endptr && env_id <= (uid_t)-1) > + *id = env_id; So we refrain from touching *id when we cannot read from SUDO_UID; let's make sure that the caller is prepared for that ... > + errno = saved_errno; > + } > +} > + > static inline int is_path_owned_by_current_uid(const char *path) > { > struct stat st; > + uid_t euid; > + > if (lstat(path, &st)) > return 0; > - return st.st_uid == geteuid(); > + > + euid = geteuid(); > + if (euid == ROOT_UID) > + extract_id_from_env("SUDO_UID", &euid); ... and it is. euid is set to the real thing, and the tweak done by the helper function may overwrite it only when the helper computed a value without an error. > + return st.st_uid == euid; OK. Looking good. Will queue. > } > > #define is_path_owned_by_current_user is_path_owned_by_current_uid
diff --git a/git-compat-util.h b/git-compat-util.h index 58fd813bd01..3c9883934f6 100644 --- a/git-compat-util.h +++ b/git-compat-util.h @@ -437,12 +437,50 @@ static inline int git_offset_1st_component(const char *path) #endif #ifndef is_path_owned_by_current_user + +#ifdef __TANDEM +#define ROOT_UID 65535 +#else +#define ROOT_UID 0 +#endif + +/* + * this helper function overrides a ROOT_UID with the one provided by + * an environment variable, do not use unless the original user is + * root + */ +static inline void extract_id_from_env(const char *env, uid_t *id) +{ + const char *real_uid = getenv(env); + + /* discard any empty values */ + if (real_uid && *real_uid) { + char *endptr; + unsigned long env_id; + int saved_errno = errno; + + errno = 0; + env_id = strtoul(real_uid, &endptr, 10); + if (!errno && !*endptr && env_id <= (uid_t)-1) + *id = env_id; + + errno = saved_errno; + } +} + static inline int is_path_owned_by_current_uid(const char *path) { struct stat st; + uid_t euid; + if (lstat(path, &st)) return 0; - return st.st_uid == geteuid(); + + euid = geteuid(); + if (euid == ROOT_UID) + extract_id_from_env("SUDO_UID", &euid); + + return st.st_uid == euid; } #define is_path_owned_by_current_user is_path_owned_by_current_uid
bdc77d1d685 (Add a function to determine whether a path is owned by the current user, 2022-03-02) checks for the effective uid of the running process using geteuid() but didn't account for cases where that user was root (because git was invoked through sudo or a compatible tool) and the original uid that repository trusted for its config was no longer known, therefore failing the following common call: guy@renard ~/Software/uncrustify $ sudo git describe --always --dirty [sudo] password for guy: fatal: unsafe repository ('/home/guy/Software/uncrustify' is owned by someone else) Attempt to detect those cases by using the environment variables that those tools create to keep track of the original user id, and do the ownership check using that instead. This assumes the environment the user is running with after going privileged can't be tampered with, and also does the check only for root to keep the most common case less complicated, but as a side effect will miss cases where sudo (or an equivalent) was used to change to another unprivileged user or where the equivalent tool used to raise privileges didn't track the original id in a sudo compatible way. Reported-by: Guy Maurel <guy.j@maurel.de> Helped-by: SZEDER Gábor <szeder.dev@gmail.com> Helped-by: Randall Becker <rsbecker@nexbridge.com> Helped-by: Phillip Wood <phillip.wood123@gmail.com> Suggested-by: Johannes Schindelin <Johannes.Schindelin@gmx.de> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> --- Changes since v1 * The helper function was completely rewritten to include all feedback, specially in areas that were too confusing and that include: - removing the return type that was only useful when doas was also supported and that is therefore no longer needed since v1. - using strtoul instead of strtol and assumed uid_t is unsigned. This is a likely more popular configuration and allows up to 2^32 uids in 32bit systems. - using errno to check for errors in strtoul, this also includes saving and restoring the previous errno even if that is not yet needed. - avoiding truncation issues in systems where sizeof(long) > sizeof(uid_t) by discarding any values that wouldn't fit in an uid_t. sudo uses unsigned int to represent the uids so no valid id should be affected. This assumes an unsigned uid_t which is not guaranteed by the standard and therefore might need adjusting later if some platform we support does not provide that (it is expected to trigger a warning at build time) - renaming variables that had confusing names * Improved comments and commit message, and spell checked twice. Sent as an RFC to make sure it fits everyone expectations and since it doesn't fully implement all suggestions that were proposed about the same time it was ready. git-compat-util.h | 40 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-)