SIP icon indicating copy to clipboard operation
SIP copied to clipboard

git cannot run when SIP directory has non-root ownership

Open noisymime opened this issue 9 months ago • 0 comments

PROBLEM

I recently updated my SIP installation (Including OS level) and noticed that the revision and revision date in the bottom right corner were not being updated correctly. Checking through the logs this was due to git not being able to run on the install directory. Recent versions of git (~2022 onwards, including Raspbian buster-security and up) have been updated to patch CVE-2022-24765 which prevents git from being run on a directory with a difference ownership to the user running git.

In my case the install directory was owned by my user ID but the systemd service was being run by root and hence the following appears in the log:

fatal: detected dubious ownership in repository at '/home/pi/OSPi'
To add an exception for this directory, call:
git config --global --add safe.directory /home/pi/OSPi
Could not use git to determine version! Command '['git', 'rev-list', '--count', 'HEAD']' returned non-zero exit status 128.

A similar error is shown for the date of last commit as well.

If the install script is used I don't believe this will be a problem as the install directory will be owned by root, but if the user has manually installed SIP with their own ownership, then this issue will be experienced.

FIX

I'd suggest that a line similar to the below be added to the bottom of sip_service.sh:

sudo git config --system --add safe.directory ${install_location}

This will bypass this check for the specific install directory and is not a security concern.

noisymime avatar May 08 '24 00:05 noisymime