Revision 8db1e8743c0f1ed241f6a1b8bf55b6fef07d6751 authored by Johannes Schindelin on 28 March 2024, 18:21:06 UTC, committed by Johannes Schindelin on 19 April 2024, 10:38:23 UTC
Critical security issues typically combine relatively common
vulnerabilities such as case confusion in file paths with other
weaknesses in order to raise the severity of the attack.

One such weakness that has haunted the Git project in many a
submodule-related CVE is that any hooks that are found are executed
during a clone operation. Examples are the `post-checkout` and
`fsmonitor` hooks.

However, Git's design calls for hooks to be disabled by default, as only
disabled example hooks are copied over from the templates in
`<prefix>/share/git-core/templates/`.

As a defense-in-depth measure, let's prevent those hooks from running.

Obviously, administrators can choose to drop enabled hooks into the
template directory, though, _and_ it is also possible to override
`core.hooksPath`, in which case the new check needs to be disabled.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
1 parent 584de0b
Raw File
fsmonitor.h
#ifndef FSMONITOR_H
#define FSMONITOR_H

#include "cache.h"
#include "dir.h"
#include "fsmonitor-settings.h"

extern struct trace_key trace_fsmonitor;

/*
 * Read the fsmonitor index extension and (if configured) restore the
 * CE_FSMONITOR_VALID state.
 */
int read_fsmonitor_extension(struct index_state *istate, const void *data, unsigned long sz);

/*
 * Fill the fsmonitor_dirty ewah bits with their state from the index,
 * before it is split during writing.
 */
void fill_fsmonitor_bitmap(struct index_state *istate);

/*
 * Write the CE_FSMONITOR_VALID state into the fsmonitor index
 * extension.  Reads from the fsmonitor_dirty ewah in the index.
 */
void write_fsmonitor_extension(struct strbuf *sb, struct index_state *istate);

/*
 * Add/remove the fsmonitor index extension
 */
void add_fsmonitor(struct index_state *istate);
void remove_fsmonitor(struct index_state *istate);

/*
 * Add/remove the fsmonitor index extension as necessary based on the current
 * core.fsmonitor setting.
 */
void tweak_fsmonitor(struct index_state *istate);

/*
 * Run the configured fsmonitor integration script and clear the
 * CE_FSMONITOR_VALID bit for any files returned as dirty.  Also invalidate
 * any corresponding untracked cache directory structures. Optimized to only
 * run the first time it is called.
 */
void refresh_fsmonitor(struct index_state *istate);

/*
 * Does the received result contain the "trivial" response?
 */
int fsmonitor_is_trivial_response(const struct strbuf *query_result);

/*
 * Check if refresh_fsmonitor has been called at least once.
 * refresh_fsmonitor is idempotent. Returns true if fsmonitor is
 * not enabled (since the state will be "fresh" w/ CE_FSMONITOR_VALID unset)
 * This version is useful for assertions
 */
static inline int is_fsmonitor_refreshed(const struct index_state *istate)
{
	enum fsmonitor_mode fsm_mode = fsm_settings__get_mode(istate->repo);

	return fsm_mode <= FSMONITOR_MODE_DISABLED ||
		istate->fsmonitor_has_run_once;
}

/*
 * Set the given cache entries CE_FSMONITOR_VALID bit. This should be
 * called any time the cache entry has been updated to reflect the
 * current state of the file on disk.
 *
 * However, never mark submodules as valid.  When commands like "git
 * status" run they might need to recurse into the submodule (using a
 * child process) to get a summary of the submodule state.  We don't
 * have (and don't want to create) the facility to translate every
 * FS event that we receive and that happens to be deep inside of a
 * submodule back to the submodule root, so we cannot correctly keep
 * track of this bit on the gitlink directory.  Therefore, we never
 * set it on submodules.
 */
static inline void mark_fsmonitor_valid(struct index_state *istate, struct cache_entry *ce)
{
	enum fsmonitor_mode fsm_mode = fsm_settings__get_mode(istate->repo);

	if (fsm_mode > FSMONITOR_MODE_DISABLED &&
	    !(ce->ce_flags & CE_FSMONITOR_VALID)) {
		if (S_ISGITLINK(ce->ce_mode))
			return;
		istate->cache_changed = 1;
		ce->ce_flags |= CE_FSMONITOR_VALID;
		trace_printf_key(&trace_fsmonitor, "mark_fsmonitor_clean '%s'", ce->name);
	}
}

/*
 * Clear the given cache entry's CE_FSMONITOR_VALID bit and invalidate
 * any corresponding untracked cache directory structures. This should
 * be called any time git creates or modifies a file that should
 * trigger an lstat() or invalidate the untracked cache for the
 * corresponding directory
 */
static inline void mark_fsmonitor_invalid(struct index_state *istate, struct cache_entry *ce)
{
	enum fsmonitor_mode fsm_mode = fsm_settings__get_mode(istate->repo);

	if (fsm_mode > FSMONITOR_MODE_DISABLED) {
		ce->ce_flags &= ~CE_FSMONITOR_VALID;
		untracked_cache_invalidate_path(istate, ce->name, 1);
		trace_printf_key(&trace_fsmonitor, "mark_fsmonitor_invalid '%s'", ce->name);
	}
}

#endif
back to top