mod_authz_svn inheritance broken?

["Kevin P. Fleming" <kp...@digium.com>]

I'm using mod_authz_svn with SVNParentPath set to /repos, with a couple 
dozen repos under that directory. I'm also using AuthzSVNAccessFile, and 
have in my file:

[groups]
managers = ....

[asterisk:/]
* = r
@managers = rw

[asterisk:/team/kpfleming/private]
* =
kpfleming = rw

However, the @managers permission from / is _not_ inheriting down to 
/team/kpfleming/private; if I don't explicitly list @managers on that 
path, the managers don't have any access.

This seems to be contrary to the documentation... have I missed something?

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: mod_authz_svn inheritance broken?

["Kevin P. Fleming" <kp...@digium.com>]

David Anderson wrote:

> Logically, the rule for sillyuser would override the group access, even 
> if the user is a part of the group.  Currently though, a group is given 
> the same priority as a user definition, so the user is granted the 
> widest possible access (here, 'rw').  I do hope to correct this someday, 
> to make the ACLs that more flexible.

That's a good thing to know, thanks for the clarification. It's a 
reasonable thing to say that the user gets the maximum set of 
permissions allowed by _all_ settings that apply to them in that path; 
given that the set of permissions can currently only consist of 'r' and 
'w' that's saying a bit much, but it's still true :-)

Now I'm going to have to simplify my access file to get rid of all the 
stuff I put in when I thought inheritance worked differently...

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: mod_authz_svn inheritance broken?

[David Anderson <da...@calixo.net>]

Kevin P. Fleming wrote:
> OK, that was my misunderstanding then... I had somehow interpreted the 
> book to be saying that '*' was only for unknown (anonymous) users, when 
> in fact it does mean all users, including anonymous ones.

To be perfectly precise, * means "Any user (including anonymous) that isn't 
mentionned in that same rule".  So in your example, * in the second rule (the 
private area) means "anyone except kpfleming".

Also note that at present, user definitions don't supersede group definitions. 
So you couldn't define:

[groups]
mygroup = sillyuser,anotheruser

[/any/path]
@mygroup = rw
sillyuser = r

Logically, the rule for sillyuser would override the group access, even if the 
user is a part of the group.  Currently though, a group is given the same 
priority as a user definition, so the user is granted the widest possible access 
(here, 'rw').  I do hope to correct this someday, to make the ACLs that more 
flexible.

- Dave.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: mod_authz_svn inheritance broken?

["Kevin P. Fleming" <kp...@digium.com>]

Rainer Sokoll wrote:

> Works as intended ;-)
> In fact, there is a simple logic behind "inheriting": Last match wins.
> So, the last match for your managers is the line "* =", which means: No
> access. If a user kpfleming comes, the next line matches and therefore,
> he is granted access.

OK, that was my misunderstanding then... I had somehow interpreted the 
book to be saying that '*' was only for unknown (anonymous) users, when 
in fact it does mean all users, including anonymous ones.

Thanks for the clue-bat ;-)

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: mod_authz_svn inheritance broken?

[Rainer Sokoll <R....@intershop.de>]

On Wed, Nov 30, 2005 at 11:14:54PM -0600, Kevin P. Fleming wrote:

> [groups]
> managers = ....
> 
> [asterisk:/]
> * = r
> @managers = rw
> 
> [asterisk:/team/kpfleming/private]
> * =
> kpfleming = rw
> 
> However, the @managers permission from / is _not_ inheriting down to 
> /team/kpfleming/private; if I don't explicitly list @managers on that 
> path, the managers don't have any access.

Works as intended ;-)
In fact, there is a simple logic behind "inheriting": Last match wins.
So, the last match for your managers is the line "* =", which means: No
access. If a user kpfleming comes, the next line matches and therefore,
he is granted access.

Rainer

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

RE: mod_authz_svn inheritance broken?

[Gavin Lambert <ga...@compacsort.com>]

Quoth Kevin P. Fleming <ma...@digium.com>:
> [asterisk:/]
> * = r
> @managers = rw
> 
> [asterisk:/team/kpfleming/private]
> * =
> kpfleming = rw
> 
> However, the @managers permission from / is _not_ inheriting down to
> /team/kpfleming/private; if I don't explicitly list @managers on that
> path, the managers don't have any access.
> 
> This seems to be contrary to the documentation... have I
> missed something?

Not that I know anything at all about mod_authz_svn, but I'd imagine
that "* = " is trumping inheritance.  ie. it does inherit the fact that
managers have read/write access and everyone else has read-only access,
but then it overrides that to say that *everyone* (including managers)
have no access, and finally that kpfleming has read/write access.

It's what makes sense, anyway, otherwise you wouldn't have any way to
selectively disable inheritance (because sometimes it won't be the
desired behaviour).


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org