From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS3215 2.6.0.0/16 X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by dcvr.yhbt.net (Postfix) with ESMTP id 1F2641F4D7 for ; Sat, 21 May 2022 13:54:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238598AbiEUNxm (ORCPT ); Sat, 21 May 2022 09:53:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49038 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354406AbiEUNxk (ORCPT ); Sat, 21 May 2022 09:53:40 -0400 Received: from vulcan.kevinlocke.name (vulcan.kevinlocke.name [IPv6:2001:19f0:5:727:1e84:17da:7c52:5ab4]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A53895486 for ; Sat, 21 May 2022 06:53:36 -0700 (PDT) Received: from kevinolos.kevinlocke.name (2600-6c67-5000-3d1b-eed1-af9b-623d-3011.res6.spectrum.com [IPv6:2600:6c67:5000:3d1b:eed1:af9b:623d:3011]) (Authenticated sender: kevin@kevinlocke.name) by vulcan.kevinlocke.name (Postfix) with ESMTPSA id 0D9272E617B0; Sat, 21 May 2022 13:53:35 +0000 (UTC) Received: by kevinolos.kevinlocke.name (Postfix, from userid 1000) id F316113003B0; Sat, 21 May 2022 07:53:32 -0600 (MDT) From: Kevin Locke To: git@vger.kernel.org Cc: Elijah Newren , Junio C Hamano Subject: [PATCH v2] setup: don't die if realpath(3) fails on getcwd(3) Date: Sat, 21 May 2022 07:53:02 -0600 Message-Id: <7c064f43ed426c9e3b54e1ae5313d6b9332a47cb.1653141169.git.kevin@kevinlocke.name> X-Mailer: git-send-email 2.35.1 In-Reply-To: <80eeba2b2a58af2a5497f398beb5c03447c41f61.1653003552.git.kevin@kevinlocke.name> References: <80eeba2b2a58af2a5497f398beb5c03447c41f61.1653003552.git.kevin@kevinlocke.name> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org Prior to Git 2.35.0, git could be run from an inaccessible working directory so long as the git repository specified by options and/or environment variables was accessible. For example: git init repo mkdir -p a/b cd a/b chmod u-x .. git -C "${PWD%/a/b}/repo" status If this example seems a bit contrived, consider running with the repository owner as a substitute UID (e.g. with runuser(1) or sudo(8)) without ensuring the working directory is accessible by that user. The code added by e6f8861bd4 ("setup: introduce startup_info->original_cwd") to preserve the working directory attempts to normalize the path using strbuf_realpath(). If that fails, as in the case above, it is treated as a fatal error. This commit treats strbuf_realpath() errors as non-fatal. If an error occurs, setup_original_cwd() will continue without applying removal prevention for cwd, resulting in the pre-2.35.0 behavior. The risk should be minimal, since git will not operate on a repository with inaccessible ancestors, this behavior is only known to occur when cwd is a descendant of the repository, an ancestor of cwd is inaccessible, and no ancestors of the repository are inaccessible. Signed-off-by: Kevin Locke --- Changes since v1: * Set startup_info->original_cwd = NULL when strbuf_realpath() fails, rather than setting it to the un-normalized path. * Add a trace message when realpath fails to aid debugging. * Remove potential realpath failure cause from comment before it. * Improve format for reference to e6f8861bd4 in commit message. * Clarify when the pre-2.35.0 behavior may occur as a result of this commit in the commit message. * Remove 'Fixes:' tag from commit message. setup.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/setup.c b/setup.c index a7b36f3ffb..22430a663c 100644 --- a/setup.c +++ b/setup.c @@ -458,11 +458,16 @@ static void setup_original_cwd(void) * not startup_info->original_cwd. */ - /* Normalize the directory */ - strbuf_realpath(&tmp, tmp_original_cwd, 1); - free((char*)tmp_original_cwd); - tmp_original_cwd = NULL; - startup_info->original_cwd = strbuf_detach(&tmp, NULL); + /* Try to normalize the directory. */ + if (strbuf_realpath(&tmp, tmp_original_cwd, 0)) { + free((char*)tmp_original_cwd); + tmp_original_cwd = NULL; + startup_info->original_cwd = strbuf_detach(&tmp, NULL); + } else { + trace_printf("realpath(cwd) failed: %s\n", strerror(errno)); + tmp_original_cwd = NULL; + goto no_prevention_needed; + } /* * Get our worktree; we only protect the current working directory -- 2.35.1