Git dubious-ownership Git refused to run because the repository folder is owned by a different system user.
Reviewed for reference consistency: August 11, 2026
Data Loss Risk
HIGH RISKGit stopped to prevent overriding unsaved work. Do not force commands without stashing or committing first.
What To Know
Where Did It Fail?
Commands That Trigger This
Technical Background
If an attacker can place a malicious `.git/config` file in a shared directory, they could trick your Git client into executing arbitrary commands with your user privileges.
Git enforces this check globally. If the ownership mismatch is intentional (like in Docker/WSL setups), the directory must be explicitly added to the `safe.directory` config list.
Where the exception is set matters as much as the exception itself. `safe.directory` is only honored in protected configuration — system, global, or command-line scope — because a repository must not be able to vouch for itself; an entry in the repo's own `.git/config` is ignored. Matching is by exact normalized path, so a value that differs in slashes or spelling has no effect.
Two details cover most edge cases. On non-Windows platforms, Git running under `sudo` also accepts the original user's ID recorded in `SUDO_UID`, so a repository you own usually still works when briefly operated as root. The wildcard value `*` disables the check entirely, and a directory with `/*` appended trusts every repository underneath it.
Underlying Causes
Frequently Asked Questions
Only if you completely trust the directory and the users who have write access to it (e.g., it is your own local development environment).
The check compares accounts, not file health: whoever owns the `.git` directory counts, and Git stops before reading anything inside it. It shipped with the 2.35.2 security fix so configs planted by another user are never read in the first place.
The asterisk turns the check off for every repository that account touches, which is defensible only on machines where no untrusted user can plant files. Listing the specific directory, or a directory with `/*` appended, keeps the boundary on shared machines.
Git accepts this setting only from protected configuration — system, global, or command-line scope — so an entry inside `.git/config` is silently ignored. Ask Git to print each definition with its scope before trusting one.
Updated clients carry the 2.35.2 ownership check, so repositories that mixed owners before — cron jobs, root-run builds, shared checkouts — simply started failing on the first command the new Git ran.