Re: As if there wasn't enough discussion about access control...

[Greg A. Woods]

[ On Thursday, September 27, 2001 at 11:05:30 (-0700), Jimmy Rimmer wrote: ]
> Subject: As if there wasn't enough discussion about access control...
>
> I've set up CVS on a Linux server.  We access it over SSH.
> 
> Currently, access is through group permissions; if you're a member of the
> 'cvs' group on the Linux box, you have full access the repository.  But if
> you're not...

very good!

> I'd like to be able to establish some sort of "checkout-only" access for the
> folks in marketing.  Is there a way to create such a thing using Unix file
> permissions?  Or do I need to dig into the administrative files?

You're most of the way there.....

I'm guessing the marketing folks don't need 100% guaranteed integrity
for their read-only access.  If that's so then you can probably do best
with a nifty little patch that the NetBSD folks created to provide a new
'-u' option to not recate read-locks (and also implicitly turns off
history logging too).  Just put the marketing guys in a separate group
that has no write acess to any part of the repository and tell them to
use "cvs -u".  You can find these patches in the following files:

ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-ak
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-al
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-am
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-an
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-ao
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-ap
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-aq
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-ar
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-current/pkgsrc/devel/cvs/patches/patch-as

(it sure would be nice if all of the NetBSD patches made it into the
common public version of CVS too -- they are all highly useful!)

Otherwise you'll have to use the "LockDir" config feature.  Search for
"LockDir" in the manual.

-- 
                                                        Greg A. Woods

+1 416 218-0098      VE3TCP      <address@hidden>     <address@hidden>
Planix, Inc. <address@hidden>;   Secrets of the Weird <address@hidden>