Apache Mod SVN Access Forbidden

Question

How do you resolve the error svn: access to '/repos/!svn/vcc/default' forbidden?

I recently upgraded a Fedora 13 server to 16, and now I'm trying to debug an access error with a Subversion server running on using Apache with mod_dav_svn.

Running:

svn ls http://myserver/repos/myproject/trunk

Lists the correct files. But when I go to commit, I get the error:

svn: access to '/repos/!svn/vcc/default' forbidden

My Apache virtualhost for svn is:

<VirtualHost *:80>
    ServerName svn.mydomain.com
    ServerAlias svn
    DocumentRoot "/var/www/html"

    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>

    <Directory "/var/www/html">
        Options Indexes FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
    </Directory>

    <Location /repos>
      Order allow,deny
      Allow from all
      DAV svn
      SVNPath /var/svn/repos

      SVNAutoversioning On

      # Authenticate with Kerberos
      AuthType Kerberos
      AuthName "Subversion Repository"
      KrbAuthRealms mydomain.com
      Krb5KeyTab /etc/httpd/conf/krb5.HTTP.keytab

      # Get people from LDAP
      AuthLDAPUrl ldap://ldap.mydomain.com/ou=people,dc=mydomain,dc=corp?uid

      # For any operations other than these, require an authenticated user.
      <LimitExcept GET PROPFIND OPTIONS REPORT>
         Require valid-user
      </LimitExcept>

    </Location>
</VirtualHost>

What's causing this error?

EDIT: In my /var/log/httpd/error_log I'm seeing a lot of these:

[Fri Jun 22 13:22:51 2012] [error] [client 10.157.10.144] ModSecurity: Warning. Operator LT matched 20 at TX:inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/base_rules/modsecurity_crs_60_correlation.conf"] [line "31"] [msg "Inbound Anomaly Score (Total Inbound Score: 15, SQLi=, XSS=): Method is not allowed by policy"] [hostname "svn.mydomain.com"] [uri "/repos/!svn/act/0510a2b7-9bbe-4f8c-b928-406f6ac38ff2"] [unique_id "T@Sp638DCAEBBCyGfioAAABK"]

I'm not entirely sure how to read this, but I'm interpreting "Method is not allowed by policy" as meaning that there's some security Apache module that might be blocking access. How do I change this?

Answer 1

Probably the www user (the user running apache) does not have write permissions for this folder.

Chack the Permissions of the folders with for example ls -l and make sure that the www user has write permissions.

Answer 2

@Cerin thanks for the answer, I just commented the following lines in Apache's configuration, restarted and it's SOLVED!! (In my case it was this file: /etc/httpd/conf.d/mod_security.conf):

1. Comment these lines:

   #LoadModule security2_module modules/mod_security2.so
   #LoadModule unique_id_module modules/mod_unique_id.so
   

2. Restart Apache server: apachectl -k restart

3. Now you should be able to do svn commits to your repository.

If not, check your SELINUX configuration, check this page also https://stackoverflow.com/questions/960241/svn-permission-denied

Note: The file location can vary (can be merged in the httpd.conf with all the other configs.)

Answer 3

Apparently, the upgrade automatically installed mod_security, whose default rules effectively break commit access for SVN.

The quick solution was yum remove mod_security. Obviously, this makes it less secure, but since it's an internal server, that's fine.

There seems to be a frustratingly large amount of mod_security documentation, but I don't have weeks to read through hundreds of docs just to find out how to make mod_security play nice with SVN.