How to get git-daemon to work in a post-CVE world?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Everyone,

I'm new to the list, just thought it's the best place to talk about
Git. I'm running a public read-only git server with git-daemon. I've
recently noticed that my repos can't be cloned and found that
particular CVE which made git to verify the owners of the git repos.

fatal: detected dubious ownership in repository at '/srv/git/mgsautils.git'

The feasible solution is to declare the directory safe in .gitconfig.
Contrary to my policy of not creating a home for my services, I made a
home for git-daemon and placed a .gitconfig there. It seems to have an
effect, because the error message has changed to the following:

fatal: detected dubious ownership in repository at '.'

Now how to solve this? It's a relative path so I wouldn't know what it
has a problem with. I obviously can't declare '.' safe in .gitconfig,
because it could have unintended consequences. I understand it's a
security feature, but it's starting to get too cumbersome to work
around to reestablish the original intended behavior. (Earlier I found
out that I also need to create a .gitconfig for my git-shell users as
well.)


Best regards,
MegaBrutal




[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]

  Powered by Linux