Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

There seems to be a path inheritance issue which is boggling me over access restrictions. For instance, if I grant rw access one group/user, and wish to restrict it some /../../secret to none, it promptly spits in my face.

Here is an example of what I'm trying to achieve in dav_svn.authz

[groups]
grp_W = a, b, c, g
grp_X = a, d, f, e
grp_Y = a, e,

[/]
* = 
@grp_Y = rw

[somerepo1:/projectPot]
@grp_W = rw

[somerepo2:/projectKettle]
@grp_X = rw

What is expected: grp_Y has rw access to all repositories, while grp_W and grp_X only have access to their respective repositories.

What occurs: grp_Y has access to all repositories, while grp_W and grp_X have access to nothing

If I flip the access ordering where I give everyone access and restrict it in each repository, it promply ignores the invalidation rule (stripping of rights) and gives everyone the access granted at the root level.

Forgoing groups, it performs the same with user specific provisions; even fully defined such as:

[/]
a = rw
b = 
c = 
d = 
e =
f = 
g = rw

[somerepo1:/projectPot]
a = rw
b = rw
c = rw
d =
e = rw
f =
g = rw

[somerepo2:/projectKettle]
a = rw
b
c
d = rw
e = rw
f = rw
g

Which yields the exact same result. According to the documentation I'm following all protocols so this is insane.

Running on Apache2 with dav_svn

share|improve this question

1 Answer 1

up vote 2 down vote accepted

After a bunch of headaches, I let this idle with * = rw at SVNParentPath level. Coming back to it, I suddenly had a stroke of obvious hit me; the read order was the issue.

Firstly, my example naming conventions were flat out wrong as it should be [<repo_name>:<path-in-repo>]. My actual conventions were correct so syntax is not the root.

The main issue is the authz file expects an order of 'specificity' where the first read rule, or available match is applied. In my case, everything would match with the root and it would be one-and-done. thus by reversing my example ordering:

[groups]
grp_W = a, b, c, g
grp_X = a, d, f, e
grp_Y = a, e,

[ProjectPot:/]
@grp_W = rw

[ProjectKettle:/]
@grp_X = rw

[/]
* = 
@grp_Y = rw

would make it accepted and perform as behaved. This is behavior NOT DOCUMENTED and in my opinion is a serious snafu over something utterly trivial.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.