Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to setup a SVN repository which the devgroup should have full privilege to read and write except for two sub folders /1 and /2.

For /1 and /2, four users should have write permission and all other users should only have read permission.

I put the following into the configuration file, but people in devgroup still have write permission in /1 and /2.

Any help would be highly appreciated.

[project:/]
@devgroup = rw

[project:/1]
@devgroup = r
user1 = rw
user2 = rw
user3 = rw
user4 = rw

[project:/2]
@devgroup = r
user1 = rw
user2 = rw
user3 = rw
user4 = rw
share|improve this question
    
The question is if your directories 1/ and 2/ are directly under the project root directory, or you have trunk/, branches/, tags/ or something else under to root dir? Otherwise, you're on the right track because more specific path definitions always take precedence. –  Vladimir Blaskov Jul 2 '12 at 9:20

1 Answer 1

You cannot remove permissions from a user already granted, therefore, by providing read/write access at the root of the repository to the @devgroup you have provided it to all sub-trees.

The way I would achieve this is by segregating your project areas into different repositories with different permissions and then using the svn:externals property to bundle these into the top level repo.

The svn:externals property can be set on any versioned directory, and its value is a multi-line table of subdirectories (relative to the versioned directory on which the property is set), optional revision flags, and fully qualified, absolute Subversion repository URLs.

$ svn propget svn:externals .
1             http://svn.example.com/repos/restricted-1
2             http://svn.example.com/repos/restricted-2

When someone checks out a working copy of the project repo , Subversion also continues to check out the items found in its externals definition.

$ svn checkout http://svn.example.com/repos/project
A  project
A  project/Makefile
A  project/integer.c
A  project/button.c
Checked out revision 148.

Fetching external item into 1
A  1/security.c
...
Checked out revision 14.

Fetching external item into 2
...

You can then place restrictions upon the two restricted repositories to prevent the @devgroup users from updating these, whilst still getting them when they checkout the main project repo.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.