| 1 | safe.bareRepository:: |
| 2 | Specifies which bare repositories Git will work with. The currently |
| 3 | supported values are: |
| 4 | + |
| 5 | -- |
| 6 | * `all`: Git works with all bare repositories. This is the default in |
| 7 | Git 2.x. |
| 8 | * `explicit`: Git only works with bare repositories specified via |
| 9 | the top-level `--git-dir` command-line option, or the `GIT_DIR` |
| 10 | environment variable (see linkgit:git[1]). This will be the default |
| 11 | in Git 3.0. |
| 12 | -- |
| 13 | + |
| 14 | If you do not use bare repositories in your workflow, then it may be |
| 15 | beneficial to set `safe.bareRepository` to `explicit` in your global |
| 16 | config. This will protect you from attacks that involve cloning a |
| 17 | repository that contains a bare repository and running a Git command |
| 18 | within that directory. |
| 19 | + |
| 20 | If you use bare repositories regularly and want to preserve the current |
| 21 | behavior after upgrading to Git 3.0, set `safe.bareRepository` to `all` |
| 22 | in your global or system config. |
| 23 | + |
| 24 | This config setting is only respected in protected configuration (see |
| 25 | <<SCOPES>>). This prevents untrusted repositories from tampering with |
| 26 | this value. |
| 27 | |
| 28 | safe.directory:: |
| 29 | These config entries specify Git-tracked directories that are |
| 30 | considered safe even if they are owned by someone other than the |
| 31 | current user. By default, Git will refuse to even parse a Git |
| 32 | config of a repository owned by someone else, let alone run its |
| 33 | hooks, and this config setting allows users to specify exceptions, |
| 34 | e.g. for intentionally shared repositories (see the `--shared` |
| 35 | option in linkgit:git-init[1]). |
| 36 | + |
| 37 | This is a multi-valued setting, i.e. you can add more than one directory |
| 38 | via `git config --add`. To reset the list of safe directories (e.g. to |
| 39 | override any such directories specified in the system config), add a |
| 40 | `safe.directory` entry with an empty value. |
| 41 | + |
| 42 | This config setting is only respected in protected configuration (see |
| 43 | <<SCOPES>>). This prevents untrusted repositories from tampering with this |
| 44 | value. |
| 45 | + |
| 46 | The value of this setting is interpolated, i.e. `~/<path>` expands to a |
| 47 | path relative to the home directory and `%(prefix)/<path>` expands to a |
| 48 | path relative to Git's (runtime) prefix. |
| 49 | + |
| 50 | To completely opt-out of this security check, set `safe.directory` to the |
| 51 | string `*`. This will allow all repositories to be treated as if their |
| 52 | directory was listed in the `safe.directory` list. If `safe.directory=*` |
| 53 | is set in system config and you want to re-enable this protection, then |
| 54 | initialize your list with an empty value before listing the repositories |
| 55 | that you deem safe. Giving a directory with `/*` appended to it will |
| 56 | allow access to all repositories under the named directory. |
| 57 | + |
| 58 | As explained, Git only allows you to access repositories owned by |
| 59 | yourself, i.e. the user who is running Git, by default. When Git |
| 60 | is running as 'root' in a non Windows platform that provides sudo, |
| 61 | however, git checks the SUDO_UID environment variable that sudo creates |
| 62 | and will allow access to the uid recorded as its value in addition to |
| 63 | the id from 'root'. |
| 64 | This is to make it easy to perform a common sequence during installation |
| 65 | "make && sudo make install". A git process running under 'sudo' runs as |
| 66 | 'root' but the 'sudo' command exports the environment variable to record |
| 67 | which id the original user has. |
| 68 | If that is not what you would prefer and want git to only trust |
| 69 | repositories that are owned by root instead, then you can remove |
| 70 | the `SUDO_UID` variable from root's environment before invoking git. |