174

After updating Git to v2.35.2.windows.1 I'm getting the following error:

fatal: unsafe repository ('F:/GitHub/my-project' is owned by someone else)
To add an exception for this directory, call:

git config --global --add safe.directory F:/GitHub/my-project

I've tried adding the parent directory of my projects to .gitconfig, but it doesn't work.

[safe]
    directory = F:/GitHub/
    directory = F:/Private/
  • Is there a workaround for this?
  • What does it actually mean by "'x' is owned by someone else"?

I don't want to add every single project I'm working on to the .gitconfig file.

7
  • 2
    In my case, I'm the only one working on my laptop. However, since I clone to root rather than my home directory (don't judge me for that), I received this error because directories that I built at the root using sudo belong to the root user and not me. Apr 14, 2022 at 1:47
  • 2
    Also note that the drive letter casing has to match, else this wont work.
    – leppie
    Apr 14, 2022 at 10:53
  • @DrLightman: you can downgrade your git version, and all things work fine. You have the choice between security and simple living (but note: now the security problem is known, so you should regularly check that nobody in your system is abusing it) Apr 14, 2022 at 11:56
  • Note: Now there is a v2.35.3.windows.1 which fixes some problems (the configuration message now is corrected, and so it fixes the problem (but still single repository at a time). (previously: it didn's tell you to add prefix, and when it complained, it missed one slash (in case of network drive with ip). Apr 19, 2022 at 6:43
  • 2
    FYI, it seem if you are using fat32 or exfat disks this is an issue. and a very stupid issue at that. Jun 19, 2022 at 3:05

24 Answers 24

152

Starting in Git v2.35.3, safe directory checks can be disabled, which will end all the "unsafe repository" errors (this will also work in the latest patch versions of 2.30-34).

This can be done by running:

git config --global --add safe.directory '*'1

It will add the following setting to your global .gitconfig file:

[safe]
    directory = *

Before disabling, make sure you understand this security measure, and why it exists. You should not do this if your repositories are stored on a shared drive.

However, if you are the sole user of your machine 100% of the time, and your repositories are stored locally, then disabling this check should, theoretically, pose no increased risk.

Also note that you can't currently combine this with a file path, as the command doesn't interpret the wildcard * as an operator per say– it just takes the "*" argument to mean "disable safe repository checks/ consider all repositories as safe".


1 - If this fails in your particular terminal program in Windows, try surrounding the wildcard with double quotes instead of single (Via this GitHub issue):
git config --global --add safe.directory "*"

14
  • 2
    I can't seem to get this to work. It does work if I specify a specific directory. Are you sure this wildcard setting works? Apr 18, 2022 at 23:51
  • 7
    @nonrectangular If you're on Windows, you might try using double quotes instead of single around the wildcard "*".
    – zcoop98
    Apr 19, 2022 at 21:17
  • 4
    Thanks @HalBurgiss. I failed to realize the wildcard is only available in git v2.35.1 and later. Ubuntu 20.04 ships with v2.25.1. Ubuntu applied the security patch to the older versions of git, including v2.25.1, so it would produce this new error, but did not patch support for this wildcard solution. See M.S. Arun's solution to use a PPA on Ubuntu 20.04 to get the latest git. Apr 20, 2022 at 18:17
  • 5
    @zcoop98 Thanks, good catch. And too bad! A wildcard would be useful.
    – asherber
    Apr 22, 2022 at 15:03
  • 13
    Yes, they fix a security issue so badly that disabling the security fix is necessary to get work done. Awesome.
    – Eric
    Jul 25, 2022 at 4:03
99

Answer

This seems to be related to this announcement of a vulnerability: https://github.blog/2022-04-12-git-security-vulnerability-announced/

I think it has less to do with your email, and more with the owner of the directories on your filesystem. Is the user you're currently logged in with also the owner of the folder? How about the parent folder? Also, are you invoking git from within the repository directory? The update is only a few hours old, so I guess things are still in flux.

For now, as the message from git suggests, execute

git config --global --add safe.directory F:/GitHub/my-project

and make sure you are calling git from within F:/GitHub/my-project for now.

EDIT: As we found out in the comments below, the owner of the parent of the directory containing the .git folder (the git repository) is the issue.
Cloning the project anew is a platform independent way to make sure you are the owner.

Sidenote

I ran into the same problem using flutter on Linux, which on my distro was installed in /opt/flutter. I am not working as root, thus I run into the same problem. Running git config --global --add safe.directory /opt/flutter did indeed fix the problem for me.

Longer edit: Clarification

Going through the post about the vulnerability again after a good night's sleep, I think a bit of clarification is in order. I'll leave the rest of the answer as is.
Lets look at the following simple directory structure.

/home/
├─ tommy/
│  ├─ .git/
│  ├─ rental_space/
│  │  ├─ mary/
│  │  │  ├─ projects/
│  │  │  │  ├─ phone_app/
│  │  │  │  │  ├─ .git/
│  │  ├─ anthony/

In this case, the user tommy owns his own directory under /home, but (for some reason) rents out space to other users, in this case mary and anthony.
If mary, by mistake, where to execute git in her directory, but outside of her phone_app project, then old git would go up the directory tree to search a .git repository. The first it finds is the one from /home/tommy/.git. This is a security risk, because another user, in this case anyone that can act as tommy, can affect mary's execution of git and possibly cause trouble.
From Git v2.35.2 and onward, the traversal will stop as soon as the directory entered belongs to a user other than mary. Say mary executed git in /home/tommy/rental_space/mary/projects, then git will check in projects, but find no .git. It will go up one directory, check in mary, but again find no .git. Then it will again go up, but rental_space belongs to tommy, not mary. The new git version will stop here and print the message we saw in the question.
Adding the directory /home/tommy/rental_space to the safe.directory variable would allow git to proceed but is, as explained, a security risk.

I used a Linux-like directory structure here, but the same is true on Windows.

14
  • Yes the current user is the owner of both project and their parent directories. And also yes I'm invoking git from within the repository directory but error still there. Thanks for your answer, I guess I'll add the directories one by one until a fix rolls out. Apr 13, 2022 at 0:01
  • 2
    Seems that for submodules, the submodule folder and .git file need correct ownership now too. i.e. adding the parent project as a safe.directory will include submodules but only if their file ownership matches current user (or perhaps the parent .git folder).
    – webaware
    Apr 13, 2022 at 4:01
  • 2
    @webaware Can't comment on your answer yet (.....), but I don't think you added much more than a minor clarification. I'll fix up my answer a bit!
    – derpda
    Apr 13, 2022 at 4:44
  • 2
    You are correct that the user.* settings are irrelevant. The security issue is that on WIndows shared drives (and potentially on any multi-user system including some Linux systems) it may be possible to trick people into running Trojan Horse software. Git tries to use the OS's concept of file-and-directory-ownership to get around this security issue.
    – torek
    Apr 13, 2022 at 4:51
  • 2
    There are other problems with trusting folders on Windows. The latest Beta of GitHub Desktop fixes the problem. Git also fails to check whether an NTFS folder's owner is a security group that the user might be in.
    – Spencer
    Apr 15, 2022 at 15:36
20

As @derpda said, it's related to a Git security vulnerability that has been fixed.

On Linux, at least, you can fix the problem by ensuring that the parent folder of the Git repository is owned by you. There isn't any need to add the safe.directory configuration setting if you can set the folder ownership appropriately.

If you need different ownership (e.g., working on a service that runs as a different user), then add your folder to the multi-value safe.directory configuration setting:

git config --global --add safe.directory /path/to/project
1
  • 7
    i wish this worked for me... my folder is on my WSL and its obv a different user to my windows system... Apr 17, 2022 at 20:07
19

I found the same issue on Windows after upgrading to version 2.35.2.windows.1.

I was able to fix it by taking ownership of the folder containing the .git folder and all the files in it.

This is the command assuming you already are in the repository folder:

takeown.exe /f . /r

Note: if you have multiple repository folders inside a work folder, you may want to take ownership of the work folder and its subfolders recursively. It takes more time to execute, but you only need to do this once.

The command would look like this under cmd.exe:

takeown.exe /f C:\Users\%USERNAME%\Work /r

Or like this under powershell.exe or pwsh.exe:

takeown.exe /f $HOME\Work /r
4
  • 7
    I would not recommend taking ownership recursively. You only need ownership of the parent folder of .git and of .git itself. For example, using your suggetsions becomes important when your project includes folders used as docker volumes. The permissions inside those folders are often different on purpose, and have no effect whatsoever on the problem with git.
    – derpda
    Apr 15, 2022 at 0:59
  • @derpda, I generally agree, but your comment is completely true only when you execute all Git commands from the repo's root. If you execute the commands from a subdirectory, the whole path up to the parent of .git needs to be owned by the current user.
    – Palec
    Apr 19, 2022 at 17:14
  • 2
    @Palec You are right about that, but in the example I gave of a docker volume, changing ownership of the directory is a bad solution - just change directory with cd instead so you can safely execute git.
    – derpda
    Apr 20, 2022 at 0:59
  • takeown also screws multiboot. git needs to do proper ACL checks. Yeah, those things that nobody uses on Linux because they are broken. They work on Windows. Pretty much always have.
    – Eric
    Jul 25, 2022 at 3:58
8

For (mainly) Visual Studio 2022 users:

This is my setup:

  • Git version 2.36.0.windows.1
  • Mounted SMB network share from my NAS \\MyNas\User as X:\
  • The remote branch was cloned into a directory on X:\.
  • My NAS and PC are not in the same domain.
  • My IDE: Visual Studio 2022 Enterprise 17.2.0 Preview 4.0 (latest)

The issue so far:

Since my NAS and PC are not in the same domain, I cannot set my PC user as the owner of the NAS directory.

When opening the repository in Visual Studio, this error showed up in the console:

Opening Repository:
X:\Repo
Git failed with a fatal error.
fatal: unsafe repository ('//MyNas/User/Repo' is owned by someone else)
To add an exception for this directory, call:

    git config --global --add safe.directory '%(prefix)///MyNas/User/Repo'

After long testing:

The issue was the portable Git installation of Visual Studio, which had the version 2.35.2. Visual Studio, even when the component "Git for Windows" was unchecked, still used its own Git-installation instead of my global Git installation.

The solution:

  1. Add the repository directory as a safe directory with the recommended command:

    git config --global --add safe.directory '%(prefix)///MyNAS/User/Repo'
    
    # Or just trust any directory (not really recommended)
    git config --global --add safe.directory *
    
  2. Update the Git-Version which Visual Studio uses. (I just took the files from the global Git installation located in C:\Program Files\Git\mingw64\bin and pasted them to C:\Program Files\Microsoft Visual Studio\2022\Preview\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Git\mingw64\bin)

Maybe an alternative of copy/pasting files, would be to make Visual Studio use the global installation of Git, like described in this Stack Overflow question: Configure Visual Studio to use system-installed Git.exe.
Note: I have not tested this alternative, since I already overwrote the Git files in my Visual Studio installation directory.

Key notes:

  • Latest Git version (2.36.0) supports safe/trusted directories.
  • Make sure your IDE is using the latest version of Git.
1
  • 3
    Yes. Just point out that %(prefix) is literally %(prefix) and not some variable substitution.
    – Spencer
    May 3, 2022 at 17:49
8

For those working on an NTFS mounted file system (probably a shared data drive with Windows), you can edit your mount options in /etc/fstab by appending defaults,uid=1000,gid=1000 to it. This is as by default; you can't permanently change the owner of .git in NTFS. These options will make everything owned by your current user (rather than by root).

1
  • Thank your, works like a charm :D I'm using bitlocker with a windows partition and the owner can acces now to the .git file.
    – silexcorp
    Apr 18, 2022 at 23:00
6

For Ubuntu 20.xx Users Fix - 2022 UPDATE:

Updating Git with this PPA provides the latest stable upstream Git version fixed this issue.

sudo add-apt-repository ppa:git-core/ppa

sudo apt update

sudo apt install git

Ref: https://git-scm.com/download/linux

2
6

It happened to me, because I'd reinstalled my Windows system, and the owner of some repository folders are the old user in the former install. So Git won't let you use those folders directly.

You can check this by PropertiesSecurityAdvancedOwner. If the current owner is something like "S-1-blah-blah", then you encountered the same problem as me.

If you are sure you are the real owner of those folders, you can just use the takeown command:

cd F:/GitHub/
takeown /f *

The /r switch does not seem to be required for my case.

1
  • I have solved this problem for YEARS by having BUILTIN\Administrators as the owner, but now I have been set back a decade because git is using Linux semantics on Windows and they shortcut doing the work with some talk about performance while all they need to check is the repo root. But properly.
    – Eric
    Jul 25, 2022 at 3:56
6

I had a local repository at my Windows PC mapped to a network folder:

n:\folder

This points to

\windows-server\folder\working-folder

When I tried to do

n:\folder> git status

there came this known error:

fatal: unsafe repository ('//windows-server/folder/working-folder' is owned by someone else) To add an exception for this directory, call:

    git config --global --add safe.directory '%(prefix)///windows-server/folder/working-folder'

To change file permissions was not possible in my case. So I tried

git config --global --add safe.directory '%(prefix)///windows-server/folder/working-folder'

but this did not work. I had to remove the ''!

Solution:

git config --global --add safe.directory %(prefix)///windows-server/folder/working-folder
2
  • upvoted, thanks - note that wildcards dont seem to work any more Nov 1, 2022 at 10:24
  • only * and not "*" works for me too. thanks!
    – Roberto
    Nov 4, 2022 at 8:13
6

In Termux on Android, you have to add the actual git repo, not the parent directory.

git config --global --add safe.directory /storage/emulated/0/src/go2null-dotfiles

You can also disable the check.

git config --global --add safe.directory '*'
5

Adding this here since it seems no-one else has, and it helped me. You can set this system-wide by running as root with --system instead of --global, eg:

sudo git config --system --add safe.directory '*'

4

I run Visual Studio sometimes as Administrator and sometimes as a normal user. This leads to the problem.

Symptoms 1

In Visual Studio - when opening a local folder - it seems as if the code is no longer added to source control.

Opening a solution in Visual Studio 2019: The above messages appear in the Git output window for each project. Opening a solution in Visual Studio 2022: It just says One or more errors occurred..

Symptoms 2

When opening a normal command prompt in the parent folder of .git executing git log shows the message

fatal: unsafe repository ('C:/GIT/MyProject' is owned by someone else)
To add an exception for this directory, call:

    git config --global --add safe.directory C:/GIT/MyProject

There are no errors when executing any command in an Administrator command prompt.

Solution

Change the owner of the MyProject folder to the normal user. Afterwards everything works fine as normal user and also as Administrator.

1
4

On Ubuntu 20.04 (Focal Fossa) and Laravel Forge (user isolation):

I tried updating Git to 2.36 as recommended in previous answers, but this did not work. I tried the GitHub solution:

git config --global --add safe.directory GIT/MyProject

and also as recommended in a previous answer:

git config --global --add safe.directory '*'

None of these worked for me.

The only thing that worked was ensuring that the ownership of the parent directory and the project directory where folder .git is located has the same owner as explained by Tc Blaize.

1
  • True. In my case while parent directory and all sub folders were owned by one user, .git and .gitignore were used by another user. Fixing owner helped
    – Vitaly
    Sep 1, 2022 at 11:10
4

I recently had the same problem, because I had to reinstall windows and copied the repository from the old system's drive.

A look at the security settings of the folders made clear that the "old users" id (the previous windows system) was set. Because the old user is unknown in the new system the dialog only showed the SID of the user.

Right click on folder -> Properties -> Security -> Advanced

enter image description here

After I changed the ownership to my actual user everything works fine again.

enter image description here

Don't forget to check the "Replace owner on subcontainers and objects". Otherwise only the acutal folder (git repo folder) will have the new ownership.

3

In my case, on an Ubuntu 20.04.4 system (Focal Fossa), the project folder had the ownership set to the application user, e.g., www-data:www-data, but the .git folder when initiated had its ownership set to root:root.

To fix this issue, I changed the ownership on my project folder to root:root so as to match its contents (including the .git folder). Then all Git actions started working as normal.

3
  • 2
    Do that imply that you run all Git operations as root? Apr 15, 2022 at 15:08
  • There must be more going on as this did not work for me. Apr 20, 2022 at 15:30
  • @PeterMortensen Not all, I only had to do that for this case and this folder alone.
    – Tc Blaize
    Apr 22, 2022 at 9:18
3

As a part of automation, our scenario involved invoking one script multiple times and we don't know the workspace upfront.

So, in our case, git config --global --add safe.directory * created multiple entries in ~/.gitconfig.

git config --global --replace-all safe.directory '*' helped us ensuring no duplicate entries.

1
  • I'm really enjoying in how git was broken for a ton of people just to "protect" a small number of people that can't seem to check their own security in shared environments. Jun 19, 2022 at 3:08
3

On windows, I use this

git config --global --add safe.directory *

or

git config --global --replace-all safe.directory *
2

On Windows, when you create a folder from an elevated prompt, it gets the owner set to the Administrators group.

Then inside it, when you clone the repository using a non-elevated prompt, it gets you as an owner. It is enough to trigger a new Git validation.

2
  • In general, I would recommend against this. It is much safer to be running usually as non-admin. On windows, we used @marcodor's solution: git config --global --add safe.directory * and it disabled this check for us (which makes sense for us) Apr 18, 2022 at 16:20
  • 2
    This answer is not suggesting to run git as admin. It only refers to creating the folder, and likely not as a solution, but that doing so causes the issue. At least on my system, I was getting the error because my project directories are owned by the 'Administrators' group.
    – Lexikos
    Apr 23, 2022 at 23:56
1

I'm running Windows 11 and WSL and I was getting this error in Sourcetree. I made two mistakes initially -- running the command from WSL, and using quotes as Sourcetree suggested. Once I ran it from cmd at C:\Users\alyssa, and without quotes, it was putting the correct syntax in the correct .gitconfig file:

C:\Users\alyssa\.gitconfig:

[safe]
    directory = %(prefix)///wsl.localhost/Ubuntu/home/alyssa/my-repo
0

OK. To add more to the soup in previous answers where the directories either aren't owned or are outside the user's home directory, a little bit of PowerShell, and I'm sure someone can translate this to Bash, can add the directories to the safe list.

The below was written on Windows, but on Linux, remove the "-replace '\','/'" as it would break anything with spaces in the path.

(ls D:\PowerShell\ParentFolder\ -Directory).FullName -replace '\\','/' | %{git config --global --add safe.directory $_}
0

This issue occurs after the Ubuntu auto package update. After checking the updates in log file, /var/log/apt/history.log, I found two Git packages updated and after that update date mess with Phabricator occurred.

git
git-man

I used the below two commands to check the previous version in the cache and installed the old version.

apt-cache policy git:amd64

Output:

git:
  Installed: (none)
  Candidate: 1:2.17.1-1ubuntu0.10
  Version table:
     1:2.17.1-1ubuntu0.10 500
        500 http://archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://archive.ubuntu.com/ubuntu bionic-security/main amd64 Packages
        100 /var/lib/dpkg/status
     ***1:2.17.0-1ubuntu1*** 500
        500 http://archive.ubuntu.com/ubuntu bionic/main amd64 Packages

sudo apt-get install git=1:2.17.0-1ubuntu1
apt-cache policy git-man:amd64

Output:

git-man:
  Installed: 1:2.17.1-1ubuntu0.10
  Candidate: 1:2.17.1-1ubuntu0.10
  Version table:
*** 1:2.17.1-1ubuntu0.10 500
        500 http://archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://archive.ubuntu.com/ubuntu bionic-security/main amd64 Packages
        100 /var/lib/dpkg/status
     1:2.17.0-1ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu bionic/main amd64 Packages

sudo apt-get install git-man=1:2.17.0-1ubuntu1
1
  • Please properly format the message with code block.
    – Ian Yang
    Apr 20, 2022 at 12:43
0

git config --global --add safe.directory '*' //star meal all

you can create all directory is safe.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – abdo Salm
    Sep 27, 2022 at 2:00
-1

We have fixed this issue by fixing the .git/objects permissions. We were actually unable to add files without sudo because of the bad permissions.

1
  • 3
    Correct me if I'm wrong, but this does not seem to be adding anything new here!
    – derpda
    Apr 15, 2022 at 1:00
-1

In my case, I just copy the message, write sudo, and then paste the message. After pressing the Enter button, the issue has gone.

For example:

sudo git config --global --add safe.directory your-path

'your-path' = as shown in the message

2
  • 2
    This solution works but like I said in my question: I have to run this for every single project in my machine. It shouldn't be like this. Apr 13, 2022 at 18:25
  • 2
    Also, you shouldn't just copy and sudo-paste a message to without understanding the implications of doing so.
    – AKX
    Apr 14, 2022 at 11:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.