Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several repositories and users set up via CollabNet Subversion Edge. I am trying to learn a bit about restricting access to a few of our repositories to only a few users, and I am running into some problems. For example, I have the following rules set:

[groups]
engineers = alexa, miked
dtil = user1, user2, user3

[/]
* = rw

[PermissionsTest:/]
~@engineers =

What I want to do is leave the other repositories alone (let anybody read or write to it, hence why I left [/] * = rw), but be able to restrict PermissionsTest in this case to just one user group. However, I can still check out and update the code in PermissionsTest as another user who is not in the engineers group.

Is it even possible to to restrict repository access with one rule? Or do I explicitly have to give access to users and groups to each repository to make this work?

share|improve this question

2 Answers 2

Subversion access control is inherited from higher levels if there isn't an explicit match at the level you want. In your case the group dtil is implicitly granted rw to the test repository since it already has rw on the parent.

If you have a model whereby most of your repositories are rw with a few restricted ones, then you have to take care to explicitly deny those users and groups that might have permissions higher up:

[PermissionsTest:/]
~@engineers =
* = 

Clean enough in your case, but as you can imagine it'll get very messy if you've got a lot of groups and repositories to look after; having to explicitly deny access is never a good approach. I'd recommend removing that lop level * = rw default and adding it back in as a policy default only to the repositories you want to be open (Principle of least privilege). It might make your config a little bigger, but it's the safer route.

share|improve this answer

Remove this first

[/]

* = rw

and give user permissions for projects explicitly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.