CVS Access Control List Extension Patch

Installation

• copy the file acl.c under src directory of CVS source distribution.
  cp acl.c /path/to/cvs-1.11.x/src/
• copy the patch file cvsacl-patch-1.2.x under CVS source distribution directory.
  cp cvsacl-patch-1.2.x /path/to/cvs-1.11.x/
• cd to CVS source directory.
  cd /path/to/cvs-1.11.x/
• apply the patch.
  patch -p0 < cvsacl-patch-1.2.x
• if you are initializing the repository after applying patch, related config files will be created with init command.
  cvs -d /path/to/repository init
• if you already have a repository, you have to add the aclconfig file to your $CVSROOT/CVSROOT/. aclconfig.default is the default configuration file, you can rename it to aclconfig, and use it .
• modify aclconfig file, if you need to change some options.
• as the last step, you have to define yourself as acl administrator.
  cvs -d /path/to/repository racl yourname:p -r ALL -d ALL
  this command gives p (acl admin) rights to user (yourname), on all repository and tags/branches.

Permission Types

• no access
  Command line character: n
  If a user given n permission, it is not allowed for any action on repository.
• read
  Command line character: r
  r permission gives only read access on repository. With r permission you are allowed to run cvs subcommands: annotate, checkout, diff, export, log, rannotate, rdiff, rlog, status.
• write
  Command line character: w
  w permission allows only cvs commit/checkin action. With w permission, you are not allowed to add/remove any file to/from repository, other permissions should be defines for that.
• tag
  Command line character: t
  t permission allows cvs tag and rtag subcommands to run, so you may control tagging and untagging operations. t permission includes r permission, since without reading you can not tag/untag a file. However t permission does not include write permission, you can not commit a file with only t permission.
• create
  Command line character: c
  c permission allows cvs add and import subcommands to run. To add or import a file/directory to repository, you have to given a c permission. Again, c permission does not include write permission, thus you may only add or import files, but you can not modify any existing file. After issuing add subcommand, you have to commit the file to complete adding. This commit subcommand is allowed because you are adding file and not modifying existing one.
• delete
  Command line character: d
  d permission allows cvs remove command to run. To remove a file/directory from repository, d permission have to set. It does not include write permission, so you can not modify contents of an existing file on repository.
• full access except admin rights
  Command line character: a
  a permission gives all access (above permissions) to repository, but it can not modify permissions. Only acl admins may modify the acl definitions.
• acl admin
  Command line character: p
  p permission means that user is an acl admin, so it is allowed to make anything on repository.

ACL Config Keywords

Use ACL definitions if set to yes. If you do not want to use ACLs for some repositories in a patched CVS server, set this keyword to no. The default is no.

Value can be any combination of valid permission types (w,r,t,c,d,t,a,p). if there is no defined ACL and default permission in access file, or no access file at all, this permissions are used. The default is p (admin rights), if aclconfig file is created with cvs init.

CVS does not have a CVSROOT/passwd file. However it can be created manually (format should be same as /etc/group). If value set to yes, CVS checks for groups in file $CVSROOT/CVSROOT/group The default value is no.

Group memberships for users are checked in file /etc/group, if value is set to yes. The default value is no.

Originally access file is put under CVSROOT/CVSROOT, if you want a different location, set value to a valid path. The default value is $CVSROOT/CVSROOT/access.

IF UseCVSGroups is set to yes, CVS looks for a group file under $CVSROOT/CVSROOT. To use a different location for group file set value to a valid path to group. The default value is $CVSROOT/CVSROOT/group.

If value is set to yes, a separate ACL file (access) is created for each directory in repository. If you have a really big repository (directories>10,000 and files>100,000), performance may drop due to a big acl file, access. Setting the value to yes, may increase performance. Normally, you will not need this. The default value is no.

Set CVSServerRunAsUser keyword to a valid system user.
Keyword iseffective only in PServer connections. When a user make a remote pserver connection to CVS, after successfull authentication cvs process switch to run as that user, or defined system user in $CVSROOT/CVSROOT/passwd. So, you also have to set unix file permissions accordingly.
A better solution:
Add a user and group such as both cvsadm.
Set CVSServerRunAsUser keyword to cvsadm.
Change unix file system permissions for your repository,
make cvsadm user and group owner, and read,write,execute permissions and setgid.
(chown cvsadm -R /path/to/your/repository)
(chgrp cvsadm -R /path/to/your/repository)
(chmod 2770 -R /path/to/your/repository)
Add yourself to cvsadm group (since you are ACL administrator).
Therefore, only users making remote connections will have access to repository if you give rights. Local users can not access to repository via a cvs client or directly.

Command Line Usage Information

Usage: cvs racl [user||group:permissions] [-Rl] [-r tag] [directories...] [files...]
        -R      Process directories recursively.
        -r rev  Existing revision/tag.
        -l      List defined ACLs.

Usage: cvs acl [user||group:permissions] [-Rl] [-r tag] [directories...] [files...]
        -R      Process directories recursively.
        -r rev  Existing revision/tag.
        -l      List defined ACLs.

• permissions assigned to username for specific directory or file.
• permissions assigned to group name for specific directory or file.
• permissions as defaults for specific directory or file.
• permissions as repository defaults.
• permissions in aclconfig file.

Examples

     /cvs/
      |
      |
      +--projectA/
      |	       |
      |        +---CVSROOT/
      |        |
      |        +---lib/
      |        |     |
      |        |     +---gnulib/
      |        |     |
      |        |     +---zlib/
      |        |
      |        +---src/
      |        |     |
      |        |     +---main.c
      |        |     |
      |        |     +---server.c
      |        |     |
      |        |     +---client.c
      |        |
      |        +---gui/
      |
      +--projectB/