Stale lock files with "anonymous" CVS

[David Wood]

We have a CVS repository here where some users have read only access 
except in a few directories, and the rest have read-write access 
everywhere.

This does work as advertised, except that when a read-only user attempts 
to put a file where they shouldn't, we end up with a stale lock. Then no 
one can use the repository until it's manually removed.

It seems that when the CVS process on our (Solaris 9) server has a 
permission problem, it dies without removing its lock files.

FYI, we are using a seperate lock directory. When CVS dies it gives the 
error:

cvs commit: ERROR: cannot write file 
/opt/cvs/repositories/primary/myproject/test/Attic/testfile2.html,v: 
Permission denied
Terminated with fatal signal 11

The read-write users map to user CVS. Read-only users map to user CVSR. 
Both belong to group CVS

Most files are rwx for user CVS, and r-x for group CVS. Directories where 
read-only users can write are rwx for user CVSR, and rwx for group CVS. 

I haven't found any information about this kind of problem over several 
days of searching. Given that the very popular anonymous CVS repositories 
around the world must use a similar technique, and such a condition would 
make them notoriously abusable (i.e. trivial, evil DOS attack), I assume I 
must be doing something wrong. 

Does anyone have any ideas?

Thanks,
-David