git-sec: adopt git-for-windows exception rules#426
Conversation
…#426) As is the case with my VM setup that can't get full trust while shared and it's not a great thing to get used to a certain set of tests to fail.
In 'git', the passed path for ownership check probably is absolute for reasons, but that's not an assumption we can make in `gitoxide`. Hence we resolve the path fully before comparing one path with another. Without this, using `gitoxide` powered applications from the current working dir set to the home (probably) wouldn't work.
|
Thanks a million! This looks good to me, but then again, I am not an authority on how to do these things. The group membership check was already implemented at some point and made by a Microsoft employee, hence it probably is the authoritative version: 9a3f0ba#diff-71eaf9b8d0991458e6650383da1d69a99dff38608f29fa716c03e67b9388c0ffR70 . If you find anything there to remove the TODO, you could do so in another PR. Thanks for all your help with this, you are definitely pushing |
|
Thanks to you too! It looks like they went with the same approach as me for the membership test. Regarding 85ab096, to make ownership checks work with networks drives, mounting the network drive as a single-letter drive has worked for me in the past. |
|
Thanks for the great suggestion! I tried it (actually the mount was already there as drive Z, I just didn't see it), but the same issue ensues. I am actually happy about it as it would be strange to have different permissions depending on the way one reaches the very same resource. Maybe there is more to mapping a drive though, after all this one was pre-created. For now it seems OK to keep this test-only environment variable switch. |
This PR implements the changes proposed in #424:
I couldn't make
CheckTokenMembershipwork with the token/handle already being opened, so I instead I made it forward a null value to have the Windows API handle the details. As part of that attempt, I also made the code prefer using a thread token instead of a process token, which seems to be preferred, and added aCloseHandlecall for the old handle.