You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Børre Gaup <bo...@samediggi.no> on 2009/02/26 15:18:18 UTC
svn up and per-directory access
Hello!
I am trying to set up a repository which has per-directory access to some
directories with apache2 (on Ubuntu).
I have set up a repository called myproject. Inside that I have two
directories, testdir1 and testdir2. testdir1 is hidden for everyone but
specific users.
When I point my web browser to http://localhost/svn/myrepository I see both
directories, and am able to access testdir1 when I give a valid username and
password.
When I check out the repository as a user allowed to read and write testdir1,
I only get testdir2 in the myrepository directory, and am not able to get to
it through svn up either.
If I check out testdir1 specifically, then I get it.
Is it supposed to work this way?
This is the apache setup for this repository:
<Location /svn/myproject>
DAV svn
SVNPath /home/svn/myproject
AuthType Basic
AuthName "myproject subversion repository"
AuthUserFile /etc/subversion/passwd
AuthzSVNAccessFile /etc/subversion/access
Satisfy Any
Require valid-user
</Location>
This is the access setup file:
[groups]
committers = user_name
[/]
* = r
@committers = rw
[/testdir1]
* =
@committers = rw
--
Børre Gaup
http://divvun.no/
Mob: +47 41 08 03 64
Work: +47 77 64 59 64
RE: svn up and per-directory access
Posted by "Gleason, Todd" <tg...@impac.com>.
> -----Original Message-----
> From: Børre Gaup [mailto:albbas@gmail.com] On Behalf Of Børre Gaup
> Sent: Friday, February 27, 2009 3:03 AM
> To: users@subversion.tigris.org
> Subject: Re: svn up and per-directory access
>
> Duorastat, guovvamánu 26. b. 2009 19.35.11 Bob Archer čálii:
> > > When I check out the repository as a user allowed to read and write
> > > testdir1,
> > > I only get testdir2 in the myrepository directory, and am not able to
> get
> > > to
> > > it through svn up either.
> > > If I check out testdir1 specifically, then I get it.
> >
> > Ok, if you are cheking out the "repository" (implies root folder to me)
> > that could be the problem.
>
> Yes, that was what I meant :)
>
> > Since your root allows "r" access for all that
> > is the access you get.... as it traverses the folders it doesn't have
> > authentication to get your testdir1.
> >
> > You should check out each folder separately.
> >
>
> But if I want to restrict access to parts of a repository, but allow
> seamless
> access to the whole repository to specific users, then what you suggest
> won't
> work.
>
> In our setup, having the folders with restricted access properly
> integrated
> with the rest of the local sandbox is important. How can we achieve that?
Very carefully? Give out read access to everyone at the root. Deny read access to restricted users while granting it back to users who should have it, on any subdirectory that isn't a parent/grandparent of the desired access directory. Repeat this as needed at each level. Then you minimize the exposure of what these restricted users can read. For example, to give restricted_users access to /foo/bar/baz:
[repo:/]
*=r
# give regular users full control (just an example)
users=rw
[repo:/no]
# restricted users can't touch this
restricted_users=
[repo:/foo/no]
# restricted users can't touch this
restricted_users=
[repo:/foo/bar/no]
# restricted users can't touch this
restricted_users=
[repo:/foo/bar/baz]
# restricted users have full access here
restricted_users=rw
So restricted_users can read the immediate contents of /, /foo, /foo/bar, and can read/write /foo/bar/baz, but they cannot even read any of the specified "no" sibling directories. As long as you keep your real data out of those directories, you should be able to keep restricted_users from even seeing anything they shouldn't.
As to how "seamless" it is for restricted_users to do a checkout at a higher level than /foo/bar/baz, I have no idea. But for the "users" group it should be no trouble.
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1240783
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
RE: svn up and per-directory access
Posted by Bob Archer <bo...@amsi.com>.
> But if I want to restrict access to parts of a repository, but allow
> seamless
> access to the whole repository to specific users, then what you suggest
> won't
> work.
Why won't it work? If there a reason you can checkout just the folders you want?
> In our setup, having the folders with restricted access properly
> integrated
> with the rest of the local sandbox is important. How can we achieve that?
I could be wrong, but the only way to get what you want it to allow read access to the entire repository for all users, and only restrict the ability to write to the various sub-folders.
I lost the thread and I can't seem to see your original message to see your config.
Are you allowing anon read access? If so, turning that off may get you what you want. It will force authentication for every read allowing svn to know who it doing the checkout and give the access to all folders.
Perhaps someone with more knowledge on this can jump in here.
BOb
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1239320
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
Re: svn up and per-directory access
Posted by Børre Gaup <bo...@samediggi.no>.
Duorastat, guovvamánu 26. b. 2009 19.35.11 Bob Archer čálii:
> > When I check out the repository as a user allowed to read and write
> > testdir1,
> > I only get testdir2 in the myrepository directory, and am not able to get
> > to
> > it through svn up either.
> > If I check out testdir1 specifically, then I get it.
>
> Ok, if you are cheking out the "repository" (implies root folder to me)
> that could be the problem.
Yes, that was what I meant :)
> Since your root allows "r" access for all that
> is the access you get.... as it traverses the folders it doesn't have
> authentication to get your testdir1.
>
> You should check out each folder separately.
>
But if I want to restrict access to parts of a repository, but allow seamless
access to the whole repository to specific users, then what you suggest won't
work.
In our setup, having the folders with restricted access properly integrated
with the rest of the local sandbox is important. How can we achieve that?
--
Børre Gaup
http://divvun.no/
Mob: +47 41 08 03 64
Work: +47 77 64 59 64
RE: svn up and per-directory access
Posted by Bob Archer <bo...@amsi.com>.
> When I check out the repository as a user allowed to read and write
> testdir1,
> I only get testdir2 in the myrepository directory, and am not able to get
> to
> it through svn up either.
> If I check out testdir1 specifically, then I get it.
Ok, if you are cheking out the "repository" (implies root folder to me) that could be the problem. Since your root allows "r" access for all that is the access you get.... as it traverses the folders it doesn't have authentication to get your testdir1.
You should check out each folder separately.
BOb
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1234215
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].