Github Actions: detected dubious ownership in repository at ‘/github/workspace’. How to fix?

Photo by Vipin Kumar on Unsplash

There was recorded a CVE-2022–24765 vulnerability that affects users working on multi-user machines, where untrusted parties have write access to the same hard disk.

In order to protect projects against the vulnerability, Github published a patch, which seriously affected services, used in repositories as shared libraries (scanners/dependencies/etc).

If the service is exposed to the problem, developer receives in Github Actions the following error within an attempt to call shared library:

But what does it mean?

The error prevents service from executing git commands in a repository owned by a different user than the current one.

Okay, and how to fix it?

Let’s look at the example in details.

For instance, developer calls a shared library service from .github/workflows/scanner.yml from his project repository to launch the scan in Github Actions:

on: [pull_request]
  
name: scan repo
jobs:
  global-deployer:
    runs-on: 'ubuntu-latest'
    
    steps:
    
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: my-scanner
        uses: me/my-scanner@master

In service me/my-scanner repository there two main configurational files:

1. Dockerfile — describes scanner image;
2. entrypoint.sh — bash script that fulfills steps of the scanner.

If a developer tries to google the error, he could find multiple answers, where people say that addition of the following string in configurational file can help:

git config --global --add safe.directory /github/workspace

The specified command marks the directory /github/workspace as safe even if it is owned by someone other than the current user.

Get janloo-security’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This is real a solution for the question, but the main point is to understand in which file this string has to be inserted: in .github/workflows/scanner.yml, in Dockerfile or in entrypoint.sh.

There are various examples of integration of the command in the code on forums, but for the current case the correct option is the only one.

So, if developer tries to insert the string in .github/workflows/scanner.yml file, the command will be fulfilled after the assemble of docker container (all containers, listed in .yml, are built at the first step), but not during the container’s running process.

That’s not correct:

      - name: Mark github workspace as safe
        run: |
          git config --global --add safe.directory /github/workspace

If developer tries to insert the string in Dockerfile file, the command will mark the directory for the docker container, but not for the instance, where it can be run.

That’s not correct:

RUN git config --global --add safe.directory /github/workspace

SOLUTION:

Developer has to put this string in the entrypoint.sh file:

#!/bin/sh

sh -c "git config --global --add safe.directory $PWD"

run-my-scaner

If developer inserts the string in entrypoint.sh file, command will be fulfilled after the building of docker container and during it’s running process. Before execution of any other commands, container receives the instruction, that it can trust to home directory ($PWD) on instance.

Summary

The information, I’ve gathered in this article was really useful for me. I hope, it will be useful for someone else. If you have any recommendations, remarks or thoughts regarding the theme, do not hesitate to leave a comment.