fatal: detected dubious ownership in repository at '/mnt/c/...' — Git inside
WSL refuses a repository owned by a different Linux user from the one running Git. Files on
the Windows drive all appear to belong to the user WSL mounted it for, so running Git as
root or as any second user trips the check. Run Git as that user, or trust the one path
with safe.directory.
The message prints the exact command: git config --global --add safe.directory
followed by the repository path. It writes one line to your own ~/.gitconfig
and changes nothing in the repository.
The error
$ whoami
nobody
$ git status
fatal: detected dubious ownership in repository at '/mnt/c/.../fixes2/ops/repo'
To add an exception for this directory, call:
git config --global --add safe.directory /mnt/c/.../fixes2/ops/repo
The path was shortened; nothing else changed. Running as root printed the same text.
Why it happens
Since Git 2.35.2, the release that fixed CVE-2022-24765, Git checks who owns a repository
before it will work in it. A .git folder planted by another user
on a shared machine could otherwise run that user's commands the moment your prompt or
editor calls git status. When the owner is not you, Git stops unless the path is
listed in safe.directory.
WSL shows the Windows drive through a mount with a fixed owner. Here
mount showed C:\ on /mnt/c type 9p (rw,noatime,aname=drvfs;...;uid=1000;gid=1000;...),
so every file under /mnt/c belongs to uid 1000, the distribution's default user.
That user never sees the error. Root (wsl -u root) and any other account do,
because to them the repository belongs to someone else. Check with id -u and ls -ldn on the folder.
The fix
$ git -c safe.directory=/mnt/c/.../fixes2/ops/repo status
On branch main
nothing to commit, working tree clean
$ GIT_CONFIG_GLOBAL=/tmp/fixes2-gitconfig git config --global --add safe.directory /mnt/c/.../fixes2/ops/repo
$ GIT_CONFIG_GLOBAL=/tmp/fixes2-gitconfig git status
On branch main
nothing to commit, working tree clean
The first line trusts the path for one command only. The second pair is the permanent fix;
the test pointed GIT_CONFIG_GLOBAL at a scratch file so it left nothing behind.
For your own account drop that prefix and run the command from the message, which adds the
line to ~/.gitconfig. Git reads safe.directory only from system,
global or command-line config; the same line in the repository's own
.git/config was ignored and the error came back.
safe.directory='*' also worked, but it trusts every repository on the machine and
switches the protection off, so keep it for a single-user machine. Often the better fix is to
stop running Git as root on /mnt/c.
How it was reproduced
A one-commit repository created with Git for Windows 2.45.2 in a scratch folder on
C:, then opened from WSL 2.7.10 with Ubuntu 24.04.4 and Git 2.43.0. The default
user (uid 1000) ran git status cleanly. The same command as nobody
(wsl -u nobody) and as root (wsl -u root) exited with code 128 and
the message above. Both fixes were confirmed as nobody, and the error returned as
soon as the override was removed.
Frequently asked
- Is it safe to set git safe.directory to '*'?
- It turns the ownership check off for every repository. On a single-user machine the risk is small. On a shared machine or a folder other people can write to, a planted repository could run commands through its config when you use Git there, so list exact paths instead.
- Why does Git in WSL say dubious ownership only as root?
- Files on /mnt/c show the owner WSL mounted the drive for, normally your default user with uid 1000. Root is a different user, so Git refuses the repository. Your normal user sees no error.
- Can I put safe.directory in the repository's .git/config?
- No. Git ignores safe.directory there, because a hostile repository could otherwise trust itself. Put it in your global config with git config --global --add safe.directory, in the system config, or pass it with git -c for one command.
More decoded errors in the Fixes category. If you run scripts in WSL as root to avoid a sudo prompt, as in 'sudo: a password is required', this is the error Git will show you on the Windows drive.