You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Adrian Marsh <Ad...@ubiquisys.com> on 2008/11/22 12:51:39 UTC
SVN https folder permissions
Hi All,
I've just redesigned and implemented some security settings for one of
my main repos, but theres a niggling glitch that I cant see a way
around. Basically how to let people see a list of top-level folders, if
they don't have access to *all* of the folders in the list
Hoping someone here can shed some light.
Heres the repos design, as an example
https://server/svn/repos/
https://server/svn/repos/folder1
https://server/svn/repos/folder1/file1.txt
https://server/svn/repos/folder2
https://server/svn/repos/ <https://server/svn/repos/folder2/file2.txt>
folder2/file2.txt
[repos:/]
[repos:/folder1]
bob = rw
[report:/folder2]
john = rw
Now bob can access folder1 and below (file1.txt), but not folder2, which
is as intended.
However, if he browses to / then he cant see any list of folders (403),
even if he does have access to folder1.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN https folder permissions
Posted by Stephane Bortzmeyer <bo...@nic.fr>.
On Sat, Nov 22, 2008 at 01:57:05PM -0000,
Adrian Marsh <Ad...@ubiquisys.com> wrote
a message of 47 lines which said:
> The security settings are doing what they should, following the
> design, however, as "bob" does have access to /folder1, then surely
> he should be able to see that at the top level of the repository??
I'm not convinced. And, apparently, the Subversion developers are not
either.
If Bob has access only to /folder1, it makes sense to tell him to go
to https://svn.example.net/folder1 and never to
https://svn.example.net/
> In linux filesystems, this would equate to an "l" file permissions I
> believe.
I'm not aware of any such permission. Unix filesystems have "r"
(read), "w" (write) and "x" (execute but, for a directory, it means
permission to traverse but not to list).
Subversion had only "r" and "w" so it cannot do some things that can
be done in an Unix filesystem.
Also, in Unix filesystems, every directory has explicit permissions,
unlike Subversion. If you want to do a similar config in Unix, you
have to set / to be readable by Bob and be sure it has no read right
everywhere but in /folder1. Not more convenient.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
RE: SVN https folder permissions
Posted by Adrian Marsh <Ad...@ubiquisys.com>.
Thanks for the reply Stephane,
If I add * = r, then I give *everyone* access to every file, everywhere
on the repository, including all subfolders. So in my example, "john"
would also then get access to folder1 as well.
The security settings are doing what they should, following the design,
however, as "bob" does have access to /folder1, then surely he should be
able to see that at the top level of the repository??
In linux filesystems, this would equate to an "l" file permissions I
believe.
Thanks,
Adrian
-----Original Message-----
From: Stephane Bortzmeyer [mailto:bortzmeyer@nic.fr]
Sent: 22 November 2008 13:26
To: Adrian Marsh
Cc: users@subversion.tigris.org
Subject: Re: SVN https folder permissions
[Warning: I'm not a Subversion security expert.]
On Sat, Nov 22, 2008 at 12:51:39PM -0000,
Adrian Marsh <Ad...@ubiquisys.com> wrote
a message of 35 lines which said:
> However, if he browses to / then he cant see any list of folders
> (403), even if he does have access to folder1.
Isn't it sensible? Bob has no access to the root (/). So it makes
sense he cannot browse it.
On a repository with these permissions, it works:
# Default
[/]
* = r
[/foobar]
* =
bob = rw
Then, at /, bob can see /foobar.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN https folder permissions
Posted by Stephane Bortzmeyer <bo...@nic.fr>.
[Warning: I'm not a Subversion security expert.]
On Sat, Nov 22, 2008 at 12:51:39PM -0000,
Adrian Marsh <Ad...@ubiquisys.com> wrote
a message of 35 lines which said:
> However, if he browses to / then he cant see any list of folders
> (403), even if he does have access to folder1.
Isn't it sensible? Bob has no access to the root (/). So it makes
sense he cannot browse it.
On a repository with these permissions, it works:
# Default
[/]
* = r
[/foobar]
* =
bob = rw
Then, at /, bob can see /foobar.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org