Understanding Git's "Dubious Ownership" Error

When using Git, you may encounter an error like the following:

fatal: detected dubious ownership in repository at '/path/to/repo'
To add an exception for this directory, call:

    git config --global --add safe.directory /path/to/repo

What Does This Mean?

This is a security feature introduced in Git 2.35.2+ to protect against potential privilege escalation and execution of malicious code. Git checks the ownership of the working directory to ensure it matches the current user. If they differ, Git considers the repository "dubious" and blocks access to protect you.

Why Does Git Care About Ownership?

Git repositories can contain hooks, config files, and scripts. If a repository is owned by a different (possibly untrusted) user, these files could contain malicious code that might execute if you run Git operations unknowingly.

Example threat: A compromised repository could include a malicious post-checkout hook that executes commands when you switch branches.

Workarounds

Option 1: Set the `HOME` Environment Variable (If Missing)

export HOME=/root
git config --global --add safe.directory /etc/msDNS/VTC

Option 2: Use the System-Level Git Config (No `$HOME` needed)

git config --system --add safe.directory /etc/msDNS/VTC

This adds the exception to /etc/gitconfig and is suitable when running as root or in automation scripts.

Best Practices

Only mark directories as safe.directory if you trust all users who can write to that directory.
Be extra cautious when running Git as root; privilege escalation through hooks is a serious risk.
Use git config --list --show-origin to verify where Git configs are coming from.
Audit any unfamiliar repositories before trusting them with safe.directory.

Tip: To inspect the repository's owner, use:

ls -ld /path/to/repo

and compare it with your current user:

whoami

Conclusion

Git's "dubious ownership" warning helps protect users from untrusted or tampered repositories. Use the recommended workarounds only when you are confident that the repository is safe.