(GH-535) Fix for safe directories #549
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Merge of #548 needed followed by rebase before work on this can continue. |
chelnak
force-pushed
the
GH-535-safe_directories
branch
3 times, most recently
from
fba9e2d
to
7f7c403
Compare
david22swan
previously approved these changes
Jun 16, 2022
chelnak
force-pushed
the
GH-535-safe_directories
branch
9 times, most recently
from
55a7859
to
2a4f83b
Compare
chelnak
changed the title
Prior to this commit, users running newer versions of Git and setting the `owner` parameter on a resource would encounter an error during puppet runs. This commit fixes the issue by allowing users to add the path of the resources to Gits global `safe.directoy` configuration. This can be achieved by specifying `safe_directory => true` on a resource.
This commit adds a section to the README that briefly describes the CVE and our mitigation to errors caused by it's remediation in later Git versions.
chelnak
force-pushed
the
GH-535-safe_directories
branch
from
2a4f83b
to
af77ebd
Compare
david22swan
approved these changes
Jun 21, 2022
LukasAud
approved these changes
Jun 21, 2022
|
@chelnak Thanks for working on that! How can I get this patch? Will this be added into future version? |
|
Hello hello! I wanted to let it rest in main for a few days just to see if anything popped up. I'll cut a release today 👍 |
|
@mfuhrmann v5.1.0 is up on the forge now 😄 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
After git was patched for CVE-2022-24765 the git binary would fail to execute in a repository that was owned by another user or group.
As of git 2.35.2, you can specify the
safe.directoryconfiguration or for prior versions define theGIT_CEILING_DIRECTORIESenvironment variable to whitelist known directories.For users of VCSRepo running newer of git, there was no obvious way to apply the remediation.
This PR will close #535 by adding a
safe_directoryproperty to the type, allowing users to explicitly mark a path as 'safe'.