File permissions (Was: Re: pserver vs. ssh - performance ...)

[Hugo van der Merwe]

On Sat, May 19, 2001 at 03:13:15PM -0400, Larry Jones wrote:
</SNIP>
> Performance should be essentially the same in either case.  ssh has a
> privacy/security advantage since the entire communication is strongly
> encrypted; pserver is somewhat easier to set up.
<SNIP>

Having now started using my CVS repository for shared projects instead
of just personal ones, I have come to wonder about file permissions...
my cvs repository belongs to the "src" group, so I add users to that
group if they should have access to the repository. (They already have
ssh access, at this moment, at a later time I might consider pserver if
I want to add people to the project that shouldn't have a shell
account...)

Now I wonder, as any of those users can modify any file in this
structure, is "trust" the only way I can stop them from messing with my
other projects? (Must I create a second repository with different "group
ownership" for this?) Secondly, with any user being able to modify
CVSROOT, as what user does the commands get executed, e.g. commit mails
from commitinfo... these run as the user doing the commit I assume? That
means any user can cause any other user to run an arbitrary command as
himself... ?

Thanks,
Hugo van der Merwe