347 lines
15 KiB
HTML
347 lines
15 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width" />
|
|
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
|
|
<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
|
|
<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
|
|
<link rel="manifest" href="/site.webmanifest" />
|
|
<link rel="me" href="https://pouet.chapril.org/@gna" />
|
|
<link rel="stylesheet" href="https://gna.org/main.css" />
|
|
<link
|
|
rel="stylesheet"
|
|
media="screen and (max-width: 1300px)"
|
|
href="https://gna.org/mobile.css"
|
|
/>
|
|
|
|
<meta name="referrer" content="no-referrer-when-downgrade" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="https://gna.org/main.css" />
|
|
<link
|
|
rel="stylesheet"
|
|
media="screen and (max-width: 1300px)"
|
|
href="https://gna.org/mobile.css"
|
|
/>
|
|
|
|
<meta name="referrer" content="no-referrer-when-downgrade" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
|
|
<title>[solved] Gitea 1.16.[678] error: fatal: unsafe repository is owned by someone else | Gna!: Managed Gitea Hosting </title>
|
|
<meta name="referrer" content="no-referrer-when-downgrade" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
|
|
<meta name="description" content="If Gitea runs as user git, calls a patched Git version and a parent directory of the git repositories is owned by a user other than git, it will fail." />
|
|
|
|
|
|
<meta property="og:title" content="[solved] Gitea 1.16.[678] error: fatal: unsafe repository is owned by someone else | Gna!: Managed Gitea Hosting " />
|
|
<meta property="og:type" content="article" />
|
|
<meta property="og:url" content="https://gna.org" />
|
|
|
|
<meta property="og:description" content="If Gitea runs as user git, calls a patched Git version and a parent directory of the git repositories is owned by a user other than git, it will fail." />
|
|
<meta
|
|
property="og:site_name"
|
|
content="[solved] Gitea 1.16.[678] error: fatal: unsafe repository is owned by someone else | Gna!: Managed Gitea Hosting "
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="57x57"
|
|
href="https://gna.org/apple-icon-57x57.png?h=c21de14cfdf862a6472ae977557fa048a7c36d39337e61d3274705e9bd8e857f"
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="60x60"
|
|
href="https://gna.org/apple-icon-60x60.png?h=67089d9025a52d0d1ddce450078c7acefe2c150a2427dec9f5e13c6314f74281"
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="72x72"
|
|
href="https://gna.org/apple-icon-72x72.png?h=70725943de8884804f9da28202ced0ad6fed483ae9cf8f6d874aa133e30cb693"
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="76x76"
|
|
href="https://gna.org/apple-icon-76x76.png?h=1e6e8072df3b21bdcea254a42aac6e993611e845f91ddd79f6f35a6c441710a5"
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="114x114"
|
|
href="https://gna.org/apple-icon-114x114.png?h=c20099f8190ed3962fab5726c5594857a871cdb3ee98439343c622cd3727fed6"
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="120x120"
|
|
href="https://gna.org/apple-icon-120x120.png?h=4df78e402e60b58c6d44764678bdd737b5b6a836aeb85fb75fa49f706f7e8c81"
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="144x144"
|
|
href="https://gna.org/apple-icon-144x144.png?h=0c44e6655d714f89ee95cc151032d1f0dc3204bd24d1ca2ee9d94692d4ede84d"
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="152x152"
|
|
href="https://gna.org/apple-icon-152x152.png?h=157918f883ff95d4eeb6452d0ebb61ca5e21ea0dcac1aefe825f3e2f3999052f"
|
|
/>
|
|
<link
|
|
rel="apple-touch-icon"
|
|
sizes="180x180"
|
|
href="https://gna.org/apple-icon-180x180.png?h=7d5c16d379b7db6d8ea5aae64921d7162b84f543763acd8fc7c107f80a600213"
|
|
/>
|
|
<link
|
|
rel="icon"
|
|
type="image/png"
|
|
sizes="192x192"
|
|
href="https://gna.org/android-icon-192x192.png?h=095e3835b082dba07f606c33fa6f71bcd671a71e987b0ab2e46dcddceef52b9c"
|
|
/>
|
|
<link
|
|
rel="icon"
|
|
type="image/png"
|
|
sizes="32x32"
|
|
href="https://gna.org/favicon-32x32.png?h=1bf54bf111572b1d1639192b5360ee4345f702e563aa71bb66610a95a7290437"
|
|
/>
|
|
<link
|
|
rel="icon"
|
|
type="image/png"
|
|
sizes="96x96"
|
|
href="https://gna.org/favicon-96x96.png?h=5a6ed96c09f5055526e3b236867a1272a26f7ba957d48b267bccd51ef0845fbe"
|
|
/>
|
|
<link
|
|
rel="icon"
|
|
type="image/png"
|
|
sizes="16x16"
|
|
href="https://gna.org/favicon-16x16.png?h=1e5fa59ae78516055f662e40bb2599dc3828a7adb34567e9d8d2cfcaa6b7aa5f"
|
|
/>
|
|
<link
|
|
rel="manifest"
|
|
href="https://gna.org/manifest.json?h=27eca3e8297eb7ff340deb3849b210185a459b3845456aa4d0036f6d966b3518"
|
|
/>
|
|
<meta name="msapplication-TileColor" content="#ffffff" />
|
|
<meta
|
|
name="msapplication-TileImage"
|
|
content="https://gna.org/ms-icon-144x144.png?h=8170ab51b871b84b8f98bd03cf441afdffb2998b7dfffb04abb7ebf5deeb1f94"
|
|
/>
|
|
<meta name="theme-color" content="#ffffff" />
|
|
|
|
|
|
</head>
|
|
|
|
|
|
|
|
|
|
</head>
|
|
<body class="base">
|
|
<header>
|
|
<nav class="nav__container">
|
|
<input type="checkbox" class="nav__toggle" id="nav__toggle" />
|
|
|
|
<div class="nav__header">
|
|
<a class="nav__logo-container" href="/">
|
|
|
|
<img src="https://gna.org/gna-logo-rectangle-48px.png?h=ba9eab043277265f94c51b87d5e14f9ca35789403ecb8afc9bd1e33b13c6a2a5" alt="Gna!"/>
|
|
</a>
|
|
<label class="nav__hamburger-menu" for="nav__toggle">
|
|
<span class="nav__hamburger-inner"></span>
|
|
</label>
|
|
</div>
|
|
<div class="nav__spacer--small"></div>
|
|
<div class="nav__link-group">
|
|
|
|
<div class="nav__link-container">
|
|
<a class="nav__link" rel="noreferrer" href="/about/">About</a>
|
|
</div>
|
|
|
|
|
|
<div class="nav__link-container">
|
|
<a class="nav__link" rel="noreferrer" href="/blog/">Blog</a>
|
|
</div>
|
|
|
|
|
|
<div class="nav__link-container">
|
|
<a class="nav__link" rel="noreferrer" href="https://matrix.to/#/#gna:matrix.batsense.net">Chat</a>
|
|
</div>
|
|
|
|
|
|
<div class="nav__link-container">
|
|
<a class="nav__link" rel="noreferrer" href="/gitea-clinic/">Clinic</a>
|
|
</div>
|
|
|
|
|
|
<div class="nav__link-container">
|
|
<a class="nav__link" rel="noreferrer" href="https://forum.gna.org">Forum</a>
|
|
</div>
|
|
|
|
|
|
<div class="nav__link-container">
|
|
<a class="nav__link" rel="noreferrer" href="https://pouet.chapril.org/@gna">Mastodon</a>
|
|
</div>
|
|
|
|
</div>
|
|
<div class="nav__spacer"></div>
|
|
<div class="nav__link-group--small">
|
|
|
|
<div class="nav__link-container">
|
|
<a class="nav__link" rel="noreferrer" href="https://hosteadashboard.gna.org/login/">Login</a>
|
|
</div>
|
|
|
|
|
|
<div class="nav__link-container--action">
|
|
<a class="nav__link" rel="noreferrer" href="https://hosteadashboard.gna.org/register/">Join</a>
|
|
</div>
|
|
|
|
</div>
|
|
</nav>
|
|
|
|
</header>
|
|
<!-- See ../sass/main.scss. Required for pushing footer to the very
|
|
bottom of the page -->
|
|
<div class="main__content-container">
|
|
<main>
|
|
|
|
|
|
<div class="page__container">
|
|
<h1 class="page__group-title">[solved] Gitea 1.16.[678] error: fatal: unsafe repository is owned by someone else</h1>
|
|
<p class="blog__post-meta">
|
|
|
|
|
|
|
|
<a href="https://dachary.org" class="post__author">Loïc Dachary</a>
|
|
|
|
|
|
|
|
|
|
· 15
|
|
May
|
|
|
|
,
|
|
2022 · <b>4 min read</b>
|
|
</p>
|
|
|
|
|
|
<div class="blog__content">
|
|
<p>April 12, 2022 version <a href="https://lore.kernel.org/git/xmqqv8veb5i6.fsf@gitster.g/">git v2.35.2</a> was released and addresses a security issue <a href="https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2">CVE-2022-24765</a>. It was backported to 2.30.3, v2.31.2, v2.32.1, v2.33.2, and v2.34.2 and published by distributions such as <a href="https://security-tracker.debian.org/tracker/CVE-2022-24765">Debian GNU/Linux</a>, <a href="https://www.alpinelinux.org/releases/">Alpine</a>.</p>
|
|
<p><strong>If Gitea runs as user <code>foo</code>, calls a patched Git version and a parent directory of the git repositories is owned by a user other than <code>foo</code>, it will fail</strong> with a message such as:</p>
|
|
<pre style="background-color:#2b303b;color:#c0c5ce;"><code><span>Failed to open repository: Git/Data Error: exit status 128 - fatal: unsafe repository ('/data/git/repositories/git/data.git' is owned by someone else)
|
|
</span></code></pre>
|
|
<p>This started to show in the past few weeks to <a href="https://github.com/go-gitea/gitea/issues/19455">users running the Gitea binary on Windows</a> who also independently installed git v2.36. And then to people running <a href="https://github.com/go-gitea/gitea/issues/19455#issuecomment-1106331149">Gitea from snap</a>, on <a href="https://github.com/go-gitea/gitea/issues/19455#issuecomment-1106312061">a Synology NAS</a> and then people running from <a href="https://github.com/go-gitea/gitea/blob/main/Dockerfile#L2">Gitea docker images</a> which is based on <a href="https://www.alpinelinux.org/releases/">Alpine</a>.</p>
|
|
<h3 id="workarounds">Workarounds<a class="zola-anchor" href="#workarounds" aria-label="Anchor link for: workarounds"
|
|
><span class="anchor-icon">#</span></a
|
|
>
|
|
</h3>
|
|
<ul>
|
|
<li>If using <a href="https://hub.docker.com/r/gitea/gitea">Gitea docker images</a>:
|
|
<ul>
|
|
<li>upgrade to <a href="https://github.com/go-gitea/gitea/pull/19876">Gitea >=1.16.9</a> or 1.17, both have git >=2.36</li>
|
|
<li><code>git config --global --replace-all safe.directory '*'</code></li>
|
|
</ul>
|
|
</li>
|
|
<li>If the Gitea binary was installed independently of git, upgrade git to a version that is <a href="https://git-scm.com/docs/git-config#Documentation/git-config.txt-safedirectory">greater or equal to 2.36</a> and disable the security check entirely with:
|
|
<ul>
|
|
<li>impersonate the <a href="https://docs.gitea.io/en-us/install-from-binary/#recommended-server-configuration">user dedicated to Gitea</a> (usually git)</li>
|
|
<li><code>git config --global --replace-all safe.directory '*'</code></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
<h3 id="bug-fix">Bug fix<a class="zola-anchor" href="#bug-fix" aria-label="Anchor link for: bug-fix"
|
|
><span class="anchor-icon">#</span></a
|
|
>
|
|
</h3>
|
|
<p>The <a href="https://github.com/go-gitea/gitea/pull/19870">bug fix</a> is for Gitea to ensure <code>git config --global --replace-all safe.directory '*'</code> is set on its <a href="https://docs.gitea.io/en-us/install-from-binary/#recommended-server-configuration">dedicated user</a> when it initializes. It is effective on the condition that the git CLI version is <a href="https://git-scm.com/docs/git-config#Documentation/git-config.txt-safedirectory">greater or equal to 2.36</a>.</p>
|
|
<h3 id="bug-fix-rationale">Bug fix rationale<a class="zola-anchor" href="#bug-fix-rationale" aria-label="Anchor link for: bug-fix-rationale"
|
|
><span class="anchor-icon">#</span></a
|
|
>
|
|
</h3>
|
|
<p>It is safe to <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/merge_requests/50/diffs">disable the security check in Gitea</a>. It is not vulnerable to <strong><a href="https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2">CVE-2022-24765</a></strong> because it calls the git CLI <a href="https://github.com/go-gitea/gitea/blob/main/modules/git/command.go#L160">after changing its working directory</a> to be the git repository targeted by the command (for instance <a href="https://github.com/go-gitea/gitea/blob/main/modules/git/diff.go#L38-L45">diff</a>) or a temporary directory. Therefore <strong>it will not explore the parent directories looking for a git configuration file</strong>.</p>
|
|
<p>The security check is triggered because the repository is owned by an unexpected user (root instead of git typically) and <strong>not because a parent directory is owned by an unexpected user</strong>. This, in itself, is a problem worth investigating but it is unrelated and was revealed by the newer security check of git even though it does not match the threat described in <strong><a href="https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2">CVE-2022-24765</a></strong>.</p>
|
|
<p>It appears non trivial to enforce a consistent ownership of files and directories, either within docker or outside docker when networked file systems are involved. The Gitea server was not troubled by this inconsistency so far because the permissions allow it to write and read where expected, regardless of the owner. It is not worth looking into but it is ancient and unrelated.</p>
|
|
<p>Gitea runs under a dedicated user, either when installed <a href="https://docs.gitea.io/en-us/install-from-binary/#recommended-server-configuration">from binary</a> or from <a href="https://docs.gitea.io/en-us/install-with-docker/">docker</a> and <a href="https://github.com/go-gitea/gitea/blob/main/modules/git/git.go#L196-L207">modifies the global git configuration</a> depending on the git version at initialization time. Fixing the problem can therefore be done by <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/merge_requests/50/diffs#bcd72ff867cbd1ddd5b6518c3a05b5f1a6021286_209_209">disabling the security check in the global git config file at initialization time</a>. It also requires a minimum version of git 2.36 to be installed, which is the case for Gitea docker images with <a href="https://github.com/go-gitea/gitea/pull/19876">versions >= 1.16.9</a>.</p>
|
|
|
|
</div>
|
|
<br>
|
|
<br>
|
|
<div class="blog__post-tag-container">
|
|
|
|
<a class="blog__post-tag" href="/tags/gna">#gna</a>
|
|
|
|
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
|
|
|
|
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
|
|
|
|
<a class="blog__post-tag" href="/tags/troubleshoot">#troubleshoot</a>
|
|
|
|
<a class="blog__post-tag" href="/tags/problem">#problem</a>
|
|
|
|
</div>
|
|
|
|
</div>
|
|
|
|
|
|
</main>
|
|
<footer>
|
|
<div class="footer__container">
|
|
<!-- <div class="footer__column"> --->
|
|
<p class="footer__column license__conatiner">
|
|
All text <a
|
|
class="license__link"
|
|
rel="noreferrer"
|
|
href="http://creativecommons.org/licenses/by-sa/4.0/"
|
|
target="_blank"
|
|
> CC-BY-SA </a
|
|
>
|
|
& code
|
|
<a
|
|
class="license__link"
|
|
rel="noreferrer"
|
|
href="https://www.gnu.org/licenses/agpl-3.0.en.html"
|
|
target="_blank"
|
|
> AGPL </a
|
|
>
|
|
|
|
|
<a
|
|
class="license__link"
|
|
rel="noreferrer"
|
|
href="https://www.eff.org/issues/do-not-track/amp/"
|
|
target="_blank"
|
|
> No AMP </a
|
|
>
|
|
</p>
|
|
<!-- </div> -->
|
|
<div class="footer__column--center">
|
|
<a href="/blog/atom.xml" target="_blank" rel="noopener" title="RSS">
|
|
<img
|
|
src="https://gna.org/icons/rss.svg?h=f6cd584bdbcd2eb4d1b8b84c9cf083ef45f772167c33fdcee754b35ae8ff4c7d"
|
|
class="footer__icon"
|
|
alt="Email icon"
|
|
/>
|
|
</a>
|
|
</div>
|
|
<div class="footer__column">
|
|
<a href="/about" title="About">About</a>
|
|
<a href="/coc" title="Code of Conduct">CoC</a>
|
|
<span class="footer__column-divider--mobile-only">|</span>
|
|
<a href="/legalese" title="Legalese">Legalese</a>
|
|
<a href="/privacy-policy" title="Privacy Policy">Privacy</a>
|
|
<span class="footer__column-divider--mobile-only">|</span>
|
|
<a
|
|
href="https://gitea.gna.org/Hostea"
|
|
rel="noreferrer"
|
|
target="_blank"
|
|
title="Status"
|
|
>Source Code</a
|
|
>
|
|
<a href="/tos" title="Terms of Service">ToS</a>
|
|
</div>
|
|
</div>
|
|
</footer>
|
|
|
|
</div>
|
|
</body>
|
|
</html>
|