You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Sander Striker <st...@apache.org> on 2003/06/10 12:02:46 UTC
Fine grained access control over ra_dav using... mod_authz_svn
Hi,
I just completed the first implementation of mod_authz_svn.
This is a stop-gap for the time we don't have acls in the
filesystem. Note that the config reading is implemented
in a very naive way; the config is reloaded at every request.
So if you see some slowdown, it could be caused by this ;).
Also, there are several things to do left in the implementation.
Search the source for comments marked with XXX.
Nevertheless I feel this is ready to see the day of light
so a few people can play with it. Personally I'd like to
see mod_authz_svn incorporated in the main repository right
next to mod_dav_svn. I'll let others comment on that first
though.
Attached is the source file for mod_authz_svn. Building it
is still a bit painful since I haven't made it into a nice
package with a 'configure' and all that. I'm hoping I don't
have to and can just ride along on the nice svn build system ;).
Compiling and installing:
APXS=/path/to/apxs
SVN_INSTALL_PATH=/path/to/svn
SVN_SOURCE_PATH=/path/to/svn-source
$APXS -c -I${SVN_INSTALL_PATH}/include/subversion-1 \
-I${SVN_SOURCE_PATH}/subversion/mod_dav_svn \
-L${SVN_INSTALL_PATH}/lib -lsvn_subr-1 \
-i mod_authz_svn.c
Then change the httpd.conf file. Add the following line
_after_ the one that loads mod_dav_svn:
LoadModule authz_svn_module modules/mod_authz_svn.so
Next set up your subversion location like so:
<Location /svn> # or whereever
DAV svn
SVNPath /path/to/repos
# Set up digest if you want...
AuthType Basic
AuthName "Subversion repository"
AuthUserFile /path/to/htpasswd/file
AuthzSVNAccessFile /path/to/access/file
Require valid-user
</Location>
Note that you are always requiring authentication now. This means
you need a dummy 'anonymous' account for anonymous read only users
now. Hopefully we can get this sorted out in Apache, since it seems
we need to do some more revamping there.
Finally, the access file format:
[groups]
<groupname> = <user>[,<user>...]
[<path in repository>]
@<group> = rw
<user> = rw
* = r
An example (line continued lines are supposed to be on one line):
[groups]
subversion = jimb,sussman,kfogel,gstein,brane,joe,ghudson,fitz,daniel,cmpilato,kevin,philip, \
jerenkrantz,rooneg,bcollins,blair,striker,naked,dwhedon,dlr,kraai,mbk,epg,bdenny,jaa
subversion-doc = nsd,zbrown,fmatias,dimentiy,patrick
subversion-bindings = xela,yoshiki,morten,jespersm,knacke
subversion-rm = mprice
...and so on and so on...
[/]
# Allow everyone read on the entire repository
* = r
# Allow devs with blanket commit to write to the entire repository
@subversion = rw
[/trunk/doc]
@subversion-doc = rw
[/trunk/subversion/bindings]
@subversion-bindings = rw
[/branches]
@subversion-rm = rw
[/tags]
@subversion-rm = rw
[/branches/issue-650-ssl-certs]
mass = rw
[/branches/pluggable-db]
gthompson = rw
...
[/secrets]
# Just for demonstration
* =
@subversion = rw
...and so on and so on...
Enjoy!
Sander
PS. I'm aware that there is no license yet at the top of the file. I want to see
if it goes into the main subversion repos first, prior to tacking on the license
we use in there.
Re: Fine grained access control over ra_dav using... mod_authz_svn
Posted by Michael Wood <mw...@its.uct.ac.za>.
On Tue, Jun 10, 2003 at 03:32:41PM -0700, John Locke wrote:
[snip]
> If there's another option, I'm all ears.
[snip]
# apachectl graceful
graceful - do a graceful restart by sending a SIGUSR1 or start if not running
--
Michael Wood <mw...@its.uct.ac.za>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Fine grained access control over ra_dav using... mod_authz_svn
Posted by Robert Spier <rs...@pobox.com>.
> - load the access file at startup time and reload when the timestamp changes
> (requires locking)
Why does this require locking? Because of the potential for threaded
MPMs?
-R
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
RE: Fine grained access control over ra_dav using... mod_authz_svn
Posted by John Locke <ma...@freelock.com>.
On Wed, 2003-06-11 at 06:20, Sander Striker wrote:
> Unfortunately, because of the current way the auth hooks work and
> are called in httpd, you cannot have one module implement group membership
> and let another benefit from it. This will probably change in some
> future version of httpd (read: whenever one of us has time to implement it).
>
I was afraid you'd say that...
> There are three options, one being
> discussed:
>
> - load the access file per connection instead of per request
> - load the access file at startup time and reload when the timestamp changes
> (requires locking)
> - load the access file at startup and require a (graceful) restart when
> someone changes it.
+1 for either of the first two options.
I'm looking for behavior like the .htaccess file, where a user can
potentially update the ACLs for their repository without requiring shell
access/ SetUID/GID scripts/ etc.
I know (and use) graceful restarts, though I have a PHP debugging module
that makes httpd segfault on a graceful restart, taking down my web site
until I do a hard restart. (I've learned to only turn this module on
when I need it!).
Still, what you've done so far fills the bill... thanks again!
Cheers,
--
John Locke
http://freelock.com
Recently published: "Extend the reach of users' email with IMAP"
http://www.techrepublic.com/article_guest.jhtml?id=r00620030507jxl01.htm
Play sports? Check in at http://teamcheckin.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
RE: Fine grained access control over ra_dav using... mod_authz_svn
Posted by Sander Striker <st...@apache.org>.
> From: John Locke [mailto:mail@freelock.com]
> Sent: Wednesday, June 11, 2003 12:33 AM
> Sander,
>
> Thank you thank you thank you!
>
> This is sweet, and means I can set up Subversion to work really well in
> my business...
>
> One question: if I use an AuthGroupFile, will this module recognize the
> groups defined in it, or do all groups have to be defined in the SVN
> Access File?
They have to be defined in the access file.
> (can you depend on the authorization module to define
> groups, and leave them out of this config?)
Unfortunately, because of the current way the auth hooks work and
are called in httpd, you cannot have one module implement group membership
and let another benefit from it. This will probably change in some
future version of httpd (read: whenever one of us has time to implement it).
> And a comment: +1 on reloading the config on each request (or at least
> leaving this as an option)...
The lack of caching will kill performance (I think).
> I would very much like to be able to update particular access files
> without restarting Apache.
But you will still be able to do that. There are three options, one being
discussed:
- load the access file per connection instead of per request
- load the access file at startup time and reload when the timestamp changes
(requires locking)
- load the access file at startup and require a (graceful) restart when
someone changes it.
> Perhaps, if this becomes a performance hit, make this a configurable option--but
> otherwise, I like the idea of having this read like .htaccess files, at
> request time rather than startup. If there's another option, I'm all
> ears.
See above ;) Just for the record: in no event do I wish to make reloading
behaviour configurable.
Sander
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Fine grained access control over ra_dav using... mod_authz_svn
Posted by John Locke <ma...@freelock.com>.
Sander,
Thank you thank you thank you!
This is sweet, and means I can set up Subversion to work really well in
my business...
One question: if I use an AuthGroupFile, will this module recognize the
groups defined in it, or do all groups have to be defined in the SVN
Access File? (can you depend on the authorization module to define
groups, and leave them out of this config?)
And a comment: +1 on reloading the config on each request (or at least
leaving this as an option)... I would very much like to be able to
update particular access files without restarting Apache. Perhaps, if
this becomes a performance hit, make this a configurable option--but
otherwise, I like the idea of having this read like .htaccess files, at
request time rather than startup. If there's another option, I'm all
ears.
Thanks again,
John
On Tue, 2003-06-10 at 05:02, Sander Striker wrote:
> Hi,
>
>
> I just completed the first implementation of mod_authz_svn.
> This is a stop-gap for the time we don't have acls in the
> filesystem. Note that the config reading is implemented
> in a very naive way; the config is reloaded at every request.
> So if you see some slowdown, it could be caused by this ;).
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Fine grained access control over ra_dav using... mod_authz_svn
Posted by Garrett Rooney <ro...@electricjellyfish.net>.
Sander Striker wrote:
>Nevertheless I feel this is ready to see the day of light
>so a few people can play with it. Personally I'd like to
>see mod_authz_svn incorporated in the main repository right
>next to mod_dav_svn. I'll let others comment on that first
>though.
>
This rocks! I'd really like to see it in the tree, and I agree with
ben, we should look at factoring some of the code out so that svnserve
can potentially offer something similar. Very nice work.
-garrett
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Fine grained access control over ra_dav using... mod_authz_svn
Posted by Justin Erenkrantz <ju...@erenkrantz.com>.
--On Tuesday, June 10, 2003 2:02 PM +0200 Sander Striker <st...@apache.org>
wrote:
> Nevertheless I feel this is ready to see the day of light
> so a few people can play with it. Personally I'd like to
> see mod_authz_svn incorporated in the main repository right
> next to mod_dav_svn. I'll let others comment on that first
> though.
Looks good on cursory review. My only comment would be to make write access
grant all methods rather than returning DECLINED for those not explicitly
mentioned. This follows the <LimitExcept ...> semantics. This way if people
come up with a new method, write privs will be assumed to cover it.
I'd say commit the sucker to the trunk. =) -- justin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Fine grained access control over ra_dav using... mod_authz_svn
Posted by Gustavo Niemeyer <ni...@conectiva.com>.
> I just completed the first implementation of mod_authz_svn.
[...]
Fantastic!! Thank you very much.
Btw, are you planning to include regex/wildcards in the future?
This is very useful in complex repository setups, like we have
here.
Thanks!
--
Gustavo Niemeyer
http://niemeyer.net
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Fine grained access control over ra_dav using... mod_authz_svn
Posted by Ben Collins-Sussman <su...@collab.net>.
"Sander Striker" <st...@apache.org> writes:
> Nevertheless I feel this is ready to see the day of light
> so a few people can play with it. Personally I'd like to
> see mod_authz_svn incorporated in the main repository right
> next to mod_dav_svn. I'll let others comment on that first
> though.
Very nice stuff, Sander! I'm definitely +1 on adding this module to
our repository. It fills a huge gap in svn-1.0 features (path-based
authorization), and will definitely satisfy most people until we
someday have real ACLs in libsvn_fs, post-1.0.
Instead of repository-level authorization, this is basically
"protocol-level" authorization. It would be even better if,
eventually, some of this code could be factorized into a shared
library, and svnserve were taught to use it as well.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org