warning: 'C:\ProgramData/Git/config' has a dubious owner: 'Administrateur'.

[glhez]

• I was not able to find an open or closed issue matching what I'm seeing

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

$ git --version --build-options
git version 2.23.0.windows.1
cpu: x86_64
built from commit: 4db2e5cc9e1522131a039cbad3970f147a39f0ce
sizeof-long: 4
sizeof-size_t: 8

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?

C:\Program Files\Git>cmd.exe /c ver

Microsoft Windows [version 10.0.17763.678]

• What options did you set as part of the installation? Or did you choose the
  defaults?

$ cat /etc/install-options.txt

Editor Option: VIM
Custom Editor Path:
Path Option: BashOnly
SSH Option: OpenSSH
Tortoise Option: false
CURL Option: OpenSSL
CRLF Option: CRLFAlways
Bash Terminal Option: MinTTY
Performance Tweaks FSCache: Enabled
Use Credential Manager: Enabled
Enable Symlinks: Enabled
Enable Builtin Interactive Add: Disabled

• Any other interesting things about your environment that might be related
  to the issue you're seeing?

My Windows 10 is a French professional OEM.

Details

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

ConEmu, Bash (""C:\Program Files\Git\git-bash.exe" --cd-to-home")

• What commands did you run to trigger this issue? If you can provide a
  Minimal, Complete, and Verifiable example
  this will help us understand the issue.

$ git status
warning: 'C:\ProgramData/Git/config' has a dubious owner: 'Administrateur'.
For security reasons, it is therefore ignored.
To fix this, please transfer ownership to an admininstrator.
On branch develop
Your branch is up to date with 'origin/develop'.

nothing to commit, working tree clean

• What did you expect to occur after running these commands?

No warning about C:\ProgramData\Git\config being owned by Administrateur.

See the following screenshot: Administrateur is French word for Administrator.
Unless the check is done with "admininstrator" which raise an error in Firefox spellcheck (want me to use administrator instead).

For records, here is the SID of the Administrator account:

C:\Program Files\Git>wmic useraccount get name,sid
Name                SID
Administrateur      S-1-5-21-1752033801-3029444-3845327491-500

• What actually happened instead?

I've got a security warning each time I launch a git command.

• If the problem was occurring with a specific repository, can you provide the
  URL to that repository to help us with testing?

No

[PhilipOakley]

Is this a virus scanner artefact? The middle section of the warning: does not look like a git error message.

warning: 'C:\ProgramData/Git/config' has a dubious owner: 'Administrateur'.
For security reasons, it is therefore ignored.
To fix this, please transfer ownership to an admininstrator.

Do you have any security software installed?

[PhilipOakley]

Hmm. Also found other reports https://developercommunity.visualstudio.com/content/problem/697976/git-failing-with-unknown-author.html (this error in VS 2019 editions)
which tend to suggest to me checking where %ProgramData% points and if that file is actually present.
Do you also have VS2019 installed?
Intriguing.

[glhez]

The only security software is the AV that ships with Windows 10. And I don't have VS2019.
I did not have this message before (I installed today 2.23).
The file mentioned by the warning exists, that's where the screenshot comes from.

[edit]
(1) renaming C:\ProgramData\Git to C:\ProgramData\Gitx fix the problem.
(2) the error message can be found in git.exe (C:\Program Files\Git\mingw64\bin\git.exe) and an hex editor: '%s' has a dubious owner: '%s'

[PhilipOakley]

@glhez
your [edit] doesn't show on the mailing list.

[edit]
(1) renaming C:\ProgramData\Git to C:\ProgramData\Gitx fix the problem.
(2) the error message can be found in git.exe (C:\Program Files\Git\mingw64\bin\git.exe) and an hex editor: '%s' has a dubious owner: '%s'

Looks like that git.exe may need a bit of decompiling to see where that message is pulled in from.
Also at (1) does that rename affect the ownership status?

[PhilipOakley]

further, the string "dubious owner" is located in libgit.lib when seen from an SDK compilation.

It looks like the string is part of a GetText list of strings, and comes shortly after a 'secur32.dll' message

# GETTEXT POISON #������secur32.dll�����GetUserNameExW��failed to validate '%s' (%ld)���invalid owner: '%s'�����unknown�(unknown)�������(some user)�����'%s' has a dubious owner: '%s'.
For security reasons, it is therefore ignored.
To fix this, please transfer ownership to an admininstrator

the <?> chars are nulls. LFs create line feeds... (copied via HxD hex editor)

It may help investigators who know this part of the code better than I.

[PhilipOakley]

I've also just seen https://stackoverflow.com/questions/57592530/latest-update-brings-github-error-on-pull-push-or-sync report and cross linked here.

[glhez]

Also at (1) does that rename affect the ownership status?

No. I could also try to reinstall Git without that folder and see what kind of permissions Git is creating the folder with. But I fear this won't work: the user I will use to install is Administrateur and I guess that the permission will be the same.

By the way, by looking at "dubious owner", I did not find anything in Github, but by the second line I found this issue : desktop/desktop#8109 which is 10 days ago. It relates to CVE-2019-1211 and a problem of file permission. It does not help me fixing the issue (beside renaming).

[PhilipOakley]

@glhez Thanks for that cross reference. I've posted a question over there as the problem is almost, but not quite identical (looks like this is a localisation issue for the same bug).
It looks like dscho is currently on holiday (well deserved).

[dscho]

This is a new warning in v2.23.0, and it is intentional.

What is not intentional is that it triggers for the "Administrateur", i.e. for any administrator.

@glhez could you have a look at https://github.com/git-for-windows/git/blob/v2.23.0.windows.1/compat/mingw.c#L3345 and investigate why this check is not sufficient to let Git know that this file is owned by an administrator?

[glhez]

Thanks for pointing the line! I rally don't understand why this line never get reported by Github "search in this repository".

For the issue, I think I found a clue (I don't have a C debugger to further confirm):

if (IsWellKnownSid(owner_sid, WinBuiltinAdministratorsSid) ||
	    IsWellKnownSid(owner_sid, WinLocalSystemSid)) {

If I understand this piece of code, this code check if the owner is either (quoted from MSDN) one of these:

Enum value	Description
WinBuiltinAdministratorsSid	Indicates a SID that matches the administrator group.
WinLocalSystemSid	Indicates a SID that matches the local system.
WinAccountAdministratorSid	Indicates a SID that matches the account administrator's account.

I've put in bold the last one because I think that's the error here: I've renamed the folder from Git to Gitx, done a uninstall/install of Git and the error is now gone: the owner of config file is now the group Administrateurs rather than the user Administrateur:

C:\Users\Gael>wmic group get name,sid
Name                                          SID
Administrateurs                               S-1-5-32-544

I clearly don't remember having made change to this folder or the file inside (the config file is the same than the newly installed one). Perhaps the permission did change at a time?

Now I only have the "/dev/fd" stuff being (/dev/fd/62: No such file or directory) annoying, but I know what I have to do (eg; #2291).

[assarbad]

Hi, you could try to check the SID of Administrateur and Administrateurs (group) using psgetsid -nobanner -accepteula Administrator. psgetsid is part of Microsoft's PSTools and therefore can be downloaded from the Microsoft website (and is code-signed). But you already gave the SID by way of wmic and a RID of 500 (the last segment of the SID) means it's the built-in administrator as was to be expected.

Anyway, the warning comes from here.

Alas, what's the likeliest explanation here is that it's indeed owned by Administrateur (the built-in administrator user) whereas the code:

	if (IsWellKnownSid(owner_sid, WinBuiltinAdministratorsSid) ||
	    IsWellKnownSid(owner_sid, WinLocalSystemSid)) {
		ret = 1;
		goto finish_validation;
	}

... checks against the ownership of the WinBuiltinAdministratorsSid (group) and WinLocalSystemSid (aka SYSTEM, the computer account ... more privileged than admins in some aspects) but should, as @glhez already pointed out, also check for WinAccountAdministratorSid ... and WinAccountDomainAdminsSid ... and potentially others like it.

In reality you probably don't want to even check outright against the SID of the owner, but rather whether that SID matches an account that is the built-in admin or member of the built-in Administrators (Administrateurs) group.

Something along the lines of this, except that for a token this is presumably somewhat more trivial.

Let me look it up and get back to you. It's been a while since I dabbled with the innards of NT security.

[dscho]

Something along the lines of this, except that for a token this is presumably somewhat more trivial.

Maybe something like this, adapted from https://docs.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-checktokenmembership:

	SID_IDENTIFIER_AUTHORITY nt_authority = SECURITY_NT_AUTHORITY;
	PSID administrators_group = NULL;
	BOOL b;

	[...]
	if (IsWellKnownSid(owner_sid, WinBuiltinAdministratorsSid) ||
	    IsWellKnownSid(owner_sid, WinLocalSystemSid) ||
	    (AllocateAndInitializeSid(&nt_authority, 2,
	                              SECURITY_BUILTIN_DOMAIN_RID,
	                              DOMAIN_ALIAS_RID_ADMINS,
	                              0, 0, 0, 0, 0, 0, &administrators_group) &&
	     CheckTokenMembership(owner_sid, AdministratorsGroup, &b) && b)) {
		ret = 1;
		goto finish_validation;
	}

	[...]
finish_validation:
	if (administrators_group)
		FreeSid(AdministratorsGroup); 

@glhez please test (if you haven't installed Git for Windows' SDK, please do so, then call sdk cd git, edit compat/mingw.c accordingly, build with sdk build git and then test with ./git config core.abc

[KalleOlaviNiemitalo]

CheckTokenMembership(owner_sid, AdministratorsGroup, &b) && b)) {

@dscho, no, you can't use PSID owner_sid as the HANDLE TokenHandle parameter of CheckTokenMembership.