Folder permissions in single SVN repo

Question

We have a large SVN repo setup with multiple folders in it such as:

/svn
     /folder1
     /folder2
     /folder3

We use SVN+SSH and put everyone into a "svn" group which owns the repo. I want to make it so that everyone can access folder1 and folder2, however only a certain group of users can access folder3 (both read and write).

Is there a way to to that ? Or should I be looking to just move folder3 out of SVN and onto something else?

Thanks

Answer 1

When you say access, do you mean SVN access (checkout / commit / etc)? If so, you may want to look at the options for authorization in svnserve itself as it allows for Path-Based Authorization.

You can read more about it here:

http://svnbook.red-bean.com/nightly/en/svn.serverconfig.pathbasedauthz.html

Answer 2

If you have control over the filesystem in the svn server and that filesystem is ACL capable (for example ext3/4) you can turn on ACLs to have a grain control over the permissions of you svn tree.

You can enable acls for your partition either by:

mount partition-name -o remount,acl

or by editing your fstab:

/dev/foo           /mount-point                   ext3    defaults,acl        1 2

Then change the permissions in your svn tree by:

~# setfacl -R -m g:"moreprivilegegroup":rwx /path/svnbase/
~# setfacl -R -d -m g:"moreprivilegegroup":rwx /path/svnbase/
~# setfacl -R -m g:"lessprivilegegroup":rwx /path/svnbase/
~# setfacl -R -d -m g:"lessprivilegegroup":rwx /path/svnbase/
~# setfacl -R -m g:"lessprivilegegroup":r-x /path/svnbase/folder3
~# setfacl -R -d -m g:"lessprivilegegroup":r-x /path/svnbase/folder3

So you'll have a group named "moreprivilegegroup" with full permissions over the full tree and a group named "lessprivilegegroup" with full permissions over the full tree but with restrictions to edit/write files in folder3 (and it's subfolders)

The directory folder3 will store the permissions for both groups which cannot be done with default unix permissions.

Populate both groups with the respective users and you'll done.

The example is not exhaustive, take it just as an example. Read setfacl and getfacl man pages for more info.