Skip to content

Conversation

sgasse
Copy link
Contributor

@sgasse sgasse commented Oct 24, 2022

Git introduced the usage of safe.directory in response to the security vulnerability CVE-2022-24765. When running ansible-lint, the directory mounted to /data is often not root-owned, but `/data is, so we get errors:

Failed to guess project directory using git: fatal: detected dubious ownership in repository at '/data'
To add an exception for this directory, call:
git config --global --add safe.directory /data
WARNING Failed to discover lintable files using git: fatal: detected dubious ownership in repository at '/data'

This commit creates a /root/.gitconfig including /data as safe directory.

Git introduced the usage of `safe.directory` in response to the security
vulnerability CVE-2022-24765. When running `ansible-lint`, the directory
mounted to `/data` is often not root-owned, but `/data is, so we get
errors:

Failed to guess project directory using git: fatal: detected dubious
ownership in repository at '/data'
To add an exception for this directory, call:
	git config --global --add safe.directory /data
WARNING  Failed to discover lintable files using git: fatal: detected
dubious ownership in repository at '/data'

This commit creates a `/root/.gitconfig` including `/data` as safe
directory.
@sgasse
Copy link
Contributor Author

sgasse commented Oct 24, 2022

Hey @cytopia ! Thanks for your great ansible-lint docker image! We have been using it in CI but this morning we discovered the issue with the git safe directory. Our current workaround is to mount a .gitconfig for root - would the proposed change make sense in general?

@cytopia cytopia self-assigned this Oct 24, 2022
@cytopia
Copy link
Owner

cytopia commented Oct 24, 2022

@sgasse thanks for the PR! I have currently not faced this issue myself. Could you provide me with a small example so that I can trigger this git behaviour on my machine

@sgasse
Copy link
Contributor Author

sgasse commented Oct 24, 2022

Hm interesting - maybe I am using ansible-lint in the wrong way?

What is the output for you if you run ansible-lint over e.g. this repository? For me, it looks like this:

sgasse:docker-ansible-lint/ (fix/sgasse/git_safe_dir) $ docker run --rm -v $(pwd):/data cytopia/ansible-lint:latest-0.7 ansible-lint /data/ansible
Failed to guess project directory using git: fatal: detected dubious ownership in repository at '/data'
To add an exception for this directory, call:

	git config --global --add safe.directory /data

Passed with production profile: 0 failure(s), 0 warning(s) on 2 files.

My docker version is Docker version 20.10.12, build 20.10.12-0ubuntu2~20.04.1

@sgasse
Copy link
Contributor Author

sgasse commented Oct 24, 2022

OK so the warning is not triggered when mounting the parent of the git repository you want to check, e.g.:

docker run --rm -v $(pwd):/data cytopia/ansible-lint:latest-0.7 ansible-lint /data/docker-ansible-lint

This hopefully explains why I ran into this issue while you did not. In most of our CI images, we mount the git repository root. Having the default mount point as safe dir would make it easier (maybe also for other users). However there are two workarounds, so it is not a critical issue:

  1. Mount the parent of the git repo that you want to check and specify the subpath.
  2. Mount a .gitconfig with the safe dir added to /root/.gitconfig in the container.

@cytopia cytopia merged commit 1dd653e into cytopia:master Nov 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants