umask problem with apache2 and mod_dav_svn

[kulve <ku...@pingu.fi>]

Hi

I have set up a development environment based on trac and svn. svn is
used using http protocol with svn command line tool and optionally
browsed through trac.

My apache2 uses suexec to exec cgi with my own account that should have
read/write group access to svn files. Using svn from command line the
dav module is used and afaik it is run as www-data user by default
(suexec has no effect there). www-data should be the owner of the files
in my setup.

The problem is that group loses sometimes the write access (because of
bad umask?). I have added "chmod g+w" hack to post-commit.sh which might
fix some issues. But it seems that always when a new logfile (e.g.
db/log.0000000004) is created it's missing the group write access and I
need to recover the database and set owner and access modes.

So, is there a way to
a) choose what user is used when accessing svn files through dav svn?

b) use some post hook to give that new logfile group write access?

c) set umask so, that new files in my svn will have group write access?


-- 
Thanks,
kulve

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: umask problem with apache2 and mod_dav_svn

[Nico Kadel-Garcia <nk...@comcast.net>]

kulve wrote:
> Dominic Anello wrote:
>>   2. Make sure every process that access the repos, even for a read
>>      operation, has the appropriate umask.  I use umask 0002
>>      Put the umask directive at the top of the apachectl script, or
>>      whatever script you use to start apache.  Also put it at the
>>      top of all your hook scripts and in your case, in your CGI
>> script.
>
> That apache serves other domains and other users as well, so this
> would affect them all, which might not be acceptable on all systems.
> So if somebody knows how to limit this setting per virtual host, or
> for dav,
> that would be great. (Maybe I should ask that in some apache mailing
> list..)
>
> At this time for my case this might actually be ok, so I'll try it
> out. Thanks

It's a good question. It looks a good job for "suexec" and virtual hosting, 
but I've never found the time to pursuie doing that, say with a "subversion" 
user accessing the subversion databases instead of Apache. 


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: umask problem with apache2 and mod_dav_svn

[kulve <ku...@pingu.fi>]

Dominic Anello wrote:
>   2. Make sure every process that access the repos, even for a read
>      operation, has the appropriate umask.  I use umask 0002
>      Put the umask directive at the top of the apachectl script, or
>      whatever script you use to start apache.  Also put it at the top of
>      all your hook scripts and in your case, in your CGI script.

That apache serves other domains and other users as well, so this would
affect them all, which might not be acceptable on all systems. So if
somebody knows how to limit this setting per virtual host, or for dav,
that would be great. (Maybe I should ask that in some apache mailing list..)

At this time for my case this might actually be ok, so I'll try it out.
Thanks

-- 
kulve

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: umask problem with apache2 and mod_dav_svn

[Dominic Anello <da...@danky.com>]

On 2006-04-26 16:03:09 +0300, kulve wrote:
> Hi
> 
> I have set up a development environment based on trac and svn. svn is
> used using http protocol with svn command line tool and optionally
> browsed through trac.
> 
> My apache2 uses suexec to exec cgi with my own account that should have
> read/write group access to svn files. Using svn from command line the
> dav module is used and afaik it is run as www-data user by default
> (suexec has no effect there). www-data should be the owner of the files
> in my setup.
> 
> The problem is that group loses sometimes the write access (because of
> bad umask?). I have added "chmod g+w" hack to post-commit.sh which might
> fix some issues. But it seems that always when a new logfile (e.g.
> db/log.0000000004) is created it's missing the group write access and I
> need to recover the database and set owner and access modes.
> 
> So, is there a way to
> a) choose what user is used when accessing svn files through dav svn?

When accessing the repos via DAV, the group of the process used to
access the repos is whatever apache is running as. You can use the 
apache Group directive to set the Group that apache runs to whatever 
group owns your repos/db directory.  This directive is global, not
setable per directory or anything like that.  It usually goes at the top
of your httpd.conf file.  I'm guessing you have something like:
Group: www-data
in there already.

Alternatively, you can chgrp the repos/db directory to whatever group 
apache is already running as.

> b) use some post hook to give that new logfile group write access?

There should be no need to do this.

> c) set umask so, that new files in my svn will have group write access?

The umask is part of it, the other half is setting SID on the repos
directory so new files get created with the appropriate permissions.  
You have to:
  1. Set the SGID flag on the db directory and make sure it is writeable
     by the group from (a). E.x.: 
     chgrp -R www-data /usr/local/svn/respos/db
     chmod g+srwx /usr/local/svn/repos/db
     chmod -R g+rw /usr/local/svn/repos/db
  2. Make sure every process that access the repos, even for a read
     operation, has the appropriate umask.  I use umask 0002
     Put the umask directive at the top of the apachectl script, or
     whatever script you use to start apache.  Also put it at the top of
     all your hook scripts and in your case, in your CGI script.
  3. Any user that needs to access the repos needs to be made a member
     of the group that owns the reos/db directory.
  
Now all log files that get created will have the appropriate group owner
and write permissions.

This is the configuration I use (I am also running trac), and I have
never had a permissions problem.

Good lock!

-Dominic

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org