Isolate git from HOME before git's own setup

Git reads the global config for its trace settings before cmd_main is
reached, so the isolation there came too late and every request probed
$HOME/.gitconfig. The home-access test had passed on arm64 only because
access is no syscall of its own there, so it now traces every call that
takes a path.

2 files changed, 9 insertions, 6 deletions

diff --git a/source/cgit.c b/source/cgit.cindex 6d663fe..5f8ecfa 100644--- a/source/cgit.c+++ b/source/cgit.c@@ -56,10 +56,12 @@ struct refmatch {  /*  * Isolate git from the calling user's configuration, which could otherwise- * break once HOME is unset below. Called from cmd_main rather than from a- * constructor attribute, because git-compat-util.h defines __attribute__- * away on a compiler without it, which would leave this silently unrun.+ * break once HOME is unset below. It runs as a constructor because git reads+ * the global config for its trace settings before cmd_main is reached, and+ * cmd_main calls it again for a compiler that drops the attribute, which+ * git-compat-util.h defines away where it is unsupported.  */+__attribute__((constructor)) static void isolate_git_environment(void) { 	setenv("GIT_CONFIG_NOSYSTEM", "1", 1);
diff --git a/source/cgit.c b/source/cgit.c
index 6d663fe..5f8ecfa 100644
--- a/source/cgit.c
+++ b/source/cgit.c
@@ -56,10 +56,12 @@ struct refmatch {
 
 /*
  * Isolate git from the calling user's configuration, which could otherwise
- * break once HOME is unset below. Called from cmd_main rather than from a
- * constructor attribute, because git-compat-util.h defines __attribute__
- * away on a compiler without it, which would leave this silently unrun.
+ * break once HOME is unset below. It runs as a constructor because git reads
+ * the global config for its trace settings before cmd_main is reached, and
+ * cmd_main calls it again for a compiler that drops the attribute, which
+ * git-compat-util.h defines away where it is unsupported.
  */
+__attribute__((constructor))
 static void isolate_git_environment(void)
 {
 	setenv("GIT_CONFIG_NOSYSTEM", "1", 1);
diff --git a/tests/t0302-home-access.sh b/tests/t0302-home-access.shindex e0da1f2..df55e0d 100755--- a/tests/t0302-home-access.sh+++ b/tests/t0302-home-access.sh@@ -3,8 +3,9 @@ # Guards the promise that cgit reads nothing out of the home directory of # whichever account the web server happens to run as. Every page is fetched # under strace with HOME pointed at a path that is known not to exist, and-# the run fails if any access call names that path, which is how a stray-# read of a personal gitconfig would show up.+# the run fails if any call taking a path names it, which is how a stray+# read of a personal gitconfig would show up. The whole file class is traced+# rather than access alone, which is no syscall of its own on arm64.  test_description='Ensure that git does not access $HOME' . ./setup.sh@@ -39,7 +40,7 @@ test_no_home_access() { 		-E HOME="$missing_home" \ 		-E CGIT_CONFIG="$PWD/cgitrc" \ 		-E QUERY_STRING="url=$1" \-		-e access -f -o strace.out cgit &&+		-e trace=%file -f -o strace.out cgit && 	! grep "$missing_home" strace.out } 
diff --git a/tests/t0302-home-access.sh b/tests/t0302-home-access.sh
index e0da1f2..df55e0d 100755
--- a/tests/t0302-home-access.sh
+++ b/tests/t0302-home-access.sh
@@ -3,8 +3,9 @@
 # Guards the promise that cgit reads nothing out of the home directory of
 # whichever account the web server happens to run as. Every page is fetched
 # under strace with HOME pointed at a path that is known not to exist, and
-# the run fails if any access call names that path, which is how a stray
-# read of a personal gitconfig would show up.
+# the run fails if any call taking a path names it, which is how a stray
+# read of a personal gitconfig would show up. The whole file class is traced
+# rather than access alone, which is no syscall of its own on arm64.
 
 test_description='Ensure that git does not access $HOME'
 . ./setup.sh
@@ -39,7 +40,7 @@ test_no_home_access() {
 		-E HOME="$missing_home" \
 		-E CGIT_CONFIG="$PWD/cgitrc" \
 		-E QUERY_STRING="url=$1" \
-		-e access -f -o strace.out cgit &&
+		-e trace=%file -f -o strace.out cgit &&
 	! grep "$missing_home" strace.out
 }