Behaviour on minor .control misconfiguration

[Daniel creo Haslinger <cr...@blackmesa.at>]

 Hey there,

 I'm here to ask you if this the following is intended behaviour
 and - if it really IS - if one should consider to think over it
 again. I'm not sure if this should go to dev@, but I decided to
 start at users@ first ;-)

 We're serving a medium sized Subversion userbase ( ~ 400 users ),
 repositories are of course maintained by the users themselves and
 of course they are managing access permissions on their own.

 Every now and then it happens that a user renders a repository
 unusable by doing misconfiguration on their .control as e.g.:


 [repo-x:/project-y]
 johndoe = rw
 janedoe = rw
 r = *


 Of course the last line is incorrect since it should have been
 * = r instead of r = *.

 From our point of view, subversion should of course send a warning
 to the logs that this line is erronous - and it actually does that,
 but as soon as it trips over this line it discards the whole
 .control and ignores it.

 There are often over 20 to 50 users on a repo that are relying
 on the SVN and just by this simple mistake the whole repo goes down.

 It it _really_ necessary to discard a whole repo config instead of
 discarding the corrupt line?



 Thanks for any hint or advice,


 creo

Re: Behaviour on minor .control misconfiguration

[David Brodbeck <br...@uw.edu>]

On Sun, Feb 20, 2011 at 12:36 PM, Daniel creo Haslinger <
creo-23985-subversion@blackmesa.at> wrote:

> I am not sure if it is proper behavior to ignore a whole file instead
> of a single misconfigured line.
>
> Of course there might be some reason to do this I'm not aware of,
> but I can't think of one yet :-)
>

The only problem I can see is it might result in more access than intended.
 e.g., what if the default is "*=rw", and I do "r=*" in an entry?  If it
just works, I might not realize right away that all users still have write
access.

On the other hand, in general the Subversion project maintainers' policy
seems to be to discourage use of path-based access control (see the box on
http://svnbook.red-bean.com/en/1.5/svn.serverconfig.pathbasedauthz.html), so
it's possible you might get some people to agree that having the security
"fail open" is desirable here.

-- 
David Brodbeck
System Administrator, Linguistics
University of Washington

Re: Behaviour on minor .control misconfiguration

[Daniel creo Haslinger <cr...@blackmesa.at>]

 Hi Daniel,

 thank you for your reply.

> Are you aware of the svnauthz-validate utility?  (Try 'make
> svnauthz-validate' in a Subversion source tree)

 I am indeed aware of the validation utility,
 but although the users have the chance to check their configuration
 I am not sure if it is proper behavior to ignore a whole file instead
 of a single misconfigured line.

 Of course there might be some reason to do this I'm not aware of,
 but I can't think of one yet :-)


 creo

 On Sun, 20 Feb 2011 20:09:13 +0200, Daniel Shahaf wrote:
>
> Daniel creo Haslinger wrote on Sun, Feb 20, 2011 at 01:49:21 +0100:
>> Hey there,
>>
>> I'm here to ask you if this the following is intended behaviour
>> and - if it really IS - if one should consider to think over it
>> again. I'm not sure if this should go to dev@, but I decided to
>> start at users@ first ;-)
>>
>> We're serving a medium sized Subversion userbase ( ~ 400 users ),
>> repositories are of course maintained by the users themselves and
>> of course they are managing access permissions on their own.
>>
>> Every now and then it happens that a user renders a repository
>> unusable by doing misconfiguration on their .control as e.g.:
>>
>>
>> [repo-x:/project-y]
>> johndoe = rw
>> janedoe = rw
>> r = *
>>
>>
>> Of course the last line is incorrect since it should have been
>> * = r instead of r = *.
>>
>> From our point of view, subversion should of course send a warning
>> to the logs that this line is erronous - and it actually does that,
>> but as soon as it trips over this line it discards the whole
>> .control and ignores it.
>>
>> There are often over 20 to 50 users on a repo that are relying
>> on the SVN and just by this simple mistake the whole repo goes down.
>>
>> It it _really_ necessary to discard a whole repo config instead of
>> discarding the corrupt line?
>>
>>
>>
>> Thanks for any hint or advice,
>>
>>
>> creo

Re: Behaviour on minor .control misconfiguration

[Daniel Shahaf <d....@daniel.shahaf.name>]

Are you aware of the svnauthz-validate utility?  (Try 'make
svnauthz-validate' in a Subversion source tree)

Daniel creo Haslinger wrote on Sun, Feb 20, 2011 at 01:49:21 +0100:
> Hey there,
> 
> I'm here to ask you if this the following is intended behaviour
> and - if it really IS - if one should consider to think over it
> again. I'm not sure if this should go to dev@, but I decided to
> start at users@ first ;-)
> 
> We're serving a medium sized Subversion userbase ( ~ 400 users ),
> repositories are of course maintained by the users themselves and
> of course they are managing access permissions on their own.
> 
> Every now and then it happens that a user renders a repository
> unusable by doing misconfiguration on their .control as e.g.:
> 
> 
> [repo-x:/project-y]
> johndoe = rw
> janedoe = rw
> r = *
> 
> 
> Of course the last line is incorrect since it should have been
> * = r instead of r = *.
> 
> From our point of view, subversion should of course send a warning
> to the logs that this line is erronous - and it actually does that,
> but as soon as it trips over this line it discards the whole
> .control and ignores it.
> 
> There are often over 20 to 50 users on a repo that are relying
> on the SVN and just by this simple mistake the whole repo goes down.
> 
> It it _really_ necessary to discard a whole repo config instead of
> discarding the corrupt line?
> 
> 
> 
> Thanks for any hint or advice,
> 
> 
> creo