Re: CVS on a solaris box with ACLs

[Noel L Yap]

>Is anybody running a cvs server from a solaris box and attempting
>to use ACLs?

I've done this.

>Some people around here are insisting that ACLs are necessary, however
>it appears that they don't interact well with chmod(). Calling chmod()
>has the affect of masking out the ACLs.

In theory, ACLs aren't necessary since you can always define whatever groups you
need and place people in those groups.  However, the number of groups you wind
up with may grow combinatorially while ACLs grow linearly.

I've never seen the problem with chmod (although I don't think I've ever
looked).  IIRC, Solaris 2.5 had problems with ACLs with regards to NFS and
setgid directories (new files didn't have the same group as that of the parent
directory).

>I'm thinking of hacking CVS to propogate ACLs from the old archive/,v
>file to the new one during commits, which seems like it will be
>straight forward, but wanted to see if there were any existing patches
>around to do this already, or if anybody had any thoughts on other
>ways to deal with ACLs.

This is exactly what we did.  I've posted our script before so check the
archives.  If you don't find it, ask me and I'll see if I can dig it up.

>Any suggestions?

Other than using loginfo scripts, I don't see any other way to do this (I'm not
convinced that CVS should directly support ACLs).

Although files can inherit default ACLs from the parent directory, this isn't
what you really want since the directories need to be writable and executable by
those needing checkin privileges -- you normally don't want archives files to be
writable.  So, archive files should inherit their parent directories' ACLs
except that the write bit should be turned off and the execute bit should be set
to what the original archive files' execute bit was.

Noel



This communication is for informational purposes only.  It is not intended as
an offer or solicitation for the purchase or sale of any financial instrument
or as an official confirmation of any transaction. All market prices, data
and other information are not warranted as to completeness or accuracy and
are subject to change without notice. Any comments or statements made herein
do not necessarily reflect those of J.P. Morgan Chase & Co. Incorporated, its
subsidiaries and affiliates.