@matheusbsbs / matheus-bagliano / commits / 4698c8feb1

config: allow inaccessible configuration under $HOME

The changes v1.7.12.1~2^2~4 (config: warn on inaccessible files, 2012-08-21) and v1.8.1.1~22^2~2 (config: treat user and xdg config permission problems as errors, 2012-10-13) were intended to prevent important configuration (think "[transfer] fsckobjects") from being ignored when the configuration is unintentionally unreadable (for example with EIO on a flaky filesystem, or with ENOMEM due to a DoS attack). Usually ~/.gitconfig and ~/.config/git are readable by the current user, and if they aren't then it would be easy to fix those permissions, so the damage from adding this check should have been minimal. Unfortunately the access() check often trips when git is being run as a server. A daemon (such as inetd or git-daemon) starts as "root", creates a listening socket, and then drops privileges, meaning that when git commands are invoked they cannot access $HOME and die with fatal: unable to access '/root/.config/git/config': Permission denied Any patch to fix this would have one of three problems: 1. We annoy sysadmins who need to take an extra step to handle HOME when dropping privileges (the current behavior, or any other proposal that they have to opt into). 2. We annoy sysadmins who want to set HOME when dropping privileges, either by making what they want to do impossible, or making them set an extra variable or option to accomplish what used to work (e.g., a patch to git-daemon to set HOME when --user is passed). 3. We loosen the check, so some cases which might be noteworthy are not caught. This patch is of type (3). Treat user and xdg configuration that are inaccessible due to permissions (EACCES) as though no user configuration was provided at all. An alternative method would be to check if $HOME is readable, but that would not help in cases where the user who dropped privileges had a globally readable HOME with only .config or .gitconfig being private. This does not change the behavior when /etc/gitconfig or .git/config is unreadable (since those are more serious configuration errors), nor when ~/.gitconfig or ~/.config/git is unreadable due to problems other than permissions. Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> Improved-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jonathan Nieder committed Apr 12, 2013 at 14:03 UTC 4698c8feb1bb56497215e0c10003dd046df352fa

5 files changed +22 -15

builtin/config.c

+2 -2

@@ -379,8 +379,8 @@ int cmd_config(int argc, const char **argv, const char *prefix)

379 */

380 die("$HOME not set");

381

382 - if (access_or_warn(user_config, R_OK) &&

383 - xdg_config && !access_or_warn(xdg_config, R_OK))

382 + if (access_or_warn(user_config, R_OK, 0) &&

383 + xdg_config && !access_or_warn(xdg_config, R_OK, 0))

384 given_config_file = xdg_config;

385 else

386 given_config_file = user_config;

config.c

+5 -5

@@ -58,7 +58,7 @@ static int handle_path_include(const char *path, struct config_include_data *inc

58 path = buf.buf;

59 }

61 - if (!access_or_die(path, R_OK)) {

61 + if (!access_or_die(path, R_OK, 0)) {

62 if (++inc->depth > MAX_INCLUDE_DEPTH)

63 die(include_depth_advice, MAX_INCLUDE_DEPTH, path,

64 cf && cf->name ? cf->name : "the command line");

@@ -954,23 +954,23 @@ int git_config_early(config_fn_t fn, void *data, const char *repo_config)

954

955 home_config_paths(&user_config, &xdg_config, "config");

956

957 - if (git_config_system() && !access_or_die(git_etc_gitconfig(), R_OK)) {

957 + if (git_config_system() && !access_or_die(git_etc_gitconfig(), R_OK, 0)) {

958 ret += git_config_from_file(fn, git_etc_gitconfig(),

959 data);

960 found += 1;

961 }

962

963 - if (xdg_config && !access_or_die(xdg_config, R_OK)) {

963 + if (xdg_config && !access_or_die(xdg_config, R_OK, ACCESS_EACCES_OK)) {

964 ret += git_config_from_file(fn, xdg_config, data);

965 found += 1;

966 }

967

968 - if (user_config && !access_or_die(user_config, R_OK)) {

968 + if (user_config && !access_or_die(user_config, R_OK, ACCESS_EACCES_OK)) {

969 ret += git_config_from_file(fn, user_config, data);

970 found += 1;

971 }

972

973 - if (repo_config && !access_or_die(repo_config, R_OK)) {

973 + if (repo_config && !access_or_die(repo_config, R_OK, 0)) {

974 ret += git_config_from_file(fn, repo_config, data);

975 found += 1;

976 }

dir.c

+2 -2

@@ -1637,9 +1637,9 @@ void setup_standard_excludes(struct dir_struct *dir)

1637 home_config_paths(NULL, &xdg_path, "ignore");

1638 excludes_file = xdg_path;

1639 }

1640 - if (!access_or_warn(path, R_OK))

1640 + if (!access_or_warn(path, R_OK, 0))

1641 add_excludes_from_file(dir, path);

1642 - if (excludes_file && !access_or_warn(excludes_file, R_OK))

1642 + if (excludes_file && !access_or_warn(excludes_file, R_OK, 0))

1643 add_excludes_from_file(dir, excludes_file);

1644 }

1645

git-compat-util.h

+3 -2

@@ -687,8 +687,9 @@ int remove_or_warn(unsigned int mode, const char *path);

687 * Call access(2), but warn for any error except "missing file"

688 * (ENOENT or ENOTDIR).

689 */

690 -int access_or_warn(const char *path, int mode);

691 -int access_or_die(const char *path, int mode);

690 +#define ACCESS_EACCES_OK (1U << 0)

691 +int access_or_warn(const char *path, int mode, unsigned flag);

692 +int access_or_die(const char *path, int mode, unsigned flag);

693

694 /* Warn on an inaccessible file that ought to be accessible */

695 void warn_on_inaccessible(const char *path);

wrapper.c

+10 -4

@@ -408,18 +408,24 @@ void warn_on_inaccessible(const char *path)

408 warning(_("unable to access '%s': %s"), path, strerror(errno));

409 }

410

411 -int access_or_warn(const char *path, int mode)

411 +static int access_error_is_ok(int err, unsigned flag)

412 +{

413 + return err == ENOENT || err == ENOTDIR ||

414 + ((flag & ACCESS_EACCES_OK) && err == EACCES);

415 +}

416 +

417 +int access_or_warn(const char *path, int mode, unsigned flag)

418 {

419 int ret = access(path, mode);

414 - if (ret && errno != ENOENT && errno != ENOTDIR)

420 + if (ret && !access_error_is_ok(errno, flag))

421 warn_on_inaccessible(path);

422 return ret;

423 }

424

419 -int access_or_die(const char *path, int mode)

425 +int access_or_die(const char *path, int mode, unsigned flag)

426 {

427 int ret = access(path, mode);

422 - if (ret && errno != ENOENT && errno != ENOTDIR)

428 + if (ret && !access_error_is_ok(errno, flag))

429 die_errno(_("unable to access '%s'"), path);

430 return ret;

431 }