CVS server group permissions

johnty01 · 01-31-2008, 04:22 PM

I've set up a CVS server for some of my school projects. Its more or less working properly, but currently I'm having the following issue:

Having a single CVS group for all the users of CVS that has ownership over the /usr/local/cvsroot, which contains the a subdir CVSROOT with all the settings, works fine.

Now what I'd like to do, is have two groups of CVS users, but each having access to only one of the subdirectories under cvsroot. so I basically remove access of either groups to CVSROOT, and hence get the following error:

cvs commit: failed to create lock directory for `/usr/local/cvsroot/CVSROOT' (/usr/local/cvsroot/CVSROOT

so my question is, would it be safe for me to assign group ownership to cvsroot/CVSROOT to both groups, while keeping the individual ownership to each subdir?

gilead · 01-31-2008, 05:24 PM

It might get messy doing it in the one repository, since both groups will need write access to some of the files in CVSROOT. That means you'll need a third group that both of the other groups belong to.

You could set up a second repository and have the users completely separated. Running multiple repositories is pretty simple. In inetd.conf (Slackware, etc.) you'd have something like:

Code:

cvspserver stream tcp nowait root /usr/bin/cvs cvs -f --allow-root=/usr/local/cvs/repo1 --allow-root=/usr/local/cvs/repo2 pserver

I don't remember the syntax for xinetd - it's been a while since I've run CVS on a box that uses it.

Wilson_Lee · 05-28-2008, 04:27 AM

hi gilead & johnty01,

I also need to setup the cvs server to provide Access Control to the directories under a repo.

I know that I can create multiple repositories for different projects. Users need to remember different repo path for different projects.

May I know is there any solution which I can do to meet the requirement to setup access control for directories under a repo?

I have tried to use chmod g+s for those directories under the repo. I also create groups and assigned to the directories. But, I fail to get the result I want.

johnty01 · 05-28-2008, 11:01 AM

Quote:

Originally Posted by Wilson_Lee

hi gilead & johnty01,

I also need to setup the cvs server to provide Access Control to the directories under a repo.

I know that I can create multiple repositories for different projects. Users need to remember different repo path for different projects.

May I know is there any solution which I can do to meet the requirement to setup access control for directories under a repo?

I have tried to use chmod g+s for those directories under the repo. I also create groups and assigned to the directories. But, I fail to get the result I want.

while i am by no means an expert on this subject, based on what gilead provided last time and my limited experience, it appears like you'll need to set up more than one repository if you want different groups to access different folders (because ultimately all groups will have to access the CVSROOT, which is common for all the directories under the repository). and i think thats where its not working for you (i tried to do the exact same thing before).

however, i wonder what happens if you gave permissions for all your groups to the CVSROOT, but assign individual access to each sub directory/module to different groups... just a thought...

ajith502 · 06-18-2009, 06:45 AM

Quote:

Originally Posted by johnty01

while i am by no means an expert on this subject, based on what gilead provided last time and my limited experience, it appears like you'll need to set up more than one repository if you want different groups to access different folders (because ultimately all groups will have to access the CVSROOT, which is common for all the directories under the repository). and i think thats where its not working for you (i tried to do the exact same thing before).

however, i wonder what happens if you gave permissions for all your groups to the CVSROOT, but assign individual access to each sub directory/module to different groups... just a thought...

I even tried out the way you have told ....

Code:

[ada@localhost temp]$ ls -al /var/lib/cvsroot/
total 20
drwxrwsr-x  5 cvs    cvsusers 4096 2009-06-18 16:49 .
drwxr-xr-x 39 root   root     4096 2009-06-18 15:24 ..
drwxrwsr-x  3 cvs    cvsusers 4096 2009-06-18 16:51 CVSROOT
drwxrwsr-x  3 ada    cvstemp  4096 2009-06-18 16:51 sesame

I had 3 users named cvs, ada, temp under cvsusers. But the users ada and temp are also under cvstemp.

In the above data you can see that I have set groupname for sesame project as cvstemp. As a result temp should be able to checkout the sesame project. But I am getting the following error

Code:

[temp@localhost SB]$ cvs -d /var/lib/cvsroot checkout sesame
cvs checkout: failed to create lock directory for `/var/lib/cvsroot/CVSROOT' (/var/lib/cvsroot/CVSROOT/#cvs.history.lock): Permission denied
cvs checkout: failed to obtain history lock in repository `/var/lib/cvsroot'
cvs checkout: Updating sesame
cvs checkout: failed to create lock directory for `/var/lib/cvsroot/sesame' (/var/lib/cvsroot/sesame/#cvs.lock): Permission denied
cvs checkout: failed to obtain dir lock in repository `/var/lib/cvsroot/sesame'
cvs [checkout aborted]: read lock failed - giving up

elimq · 06-09-2010, 06:05 PM

I can import projects to my cvs repository only when the repository set to group owner cvs. Which is fine to me.

But I found the project folder/files that I checked into the repository have group name other than cvs (in fact, that's my username). And that prevents others to check out my code.

How do I fix such problem?

Thanks a lot