Greg Hudson wrote:
> On Mon, 2003-11-24 at 14:31, John Peacock wrote:
>
>>Because the only time that this is _sufficient_ is when the repository is
>>private to the user creating it.
>
>
> That's not true; and moreover, I'm a bit confused about which use cases
> you think your patch will solve.
I meant that _only_ using 'svnadmin create' as the db owner is only sufficient
for access by that owner. In each of the use cases you cite after the first
two, additional setup steps are required beyond just 'svnadmin create' (which
kind of plays into my hands ;~).
<snip>
> Use case: I create a repository for use with ra_dav or (non-tunneled)
> ra_svn, running the daemon as root. The defaults work fine, no matter
> who I create the repository as.
You're cheating here; root trumps the filesystem permissions... ;~) This is
also not a mode I would think we should be recommending (being that there have
been DAV filesystem security exploits already identified).
>
> Use case: I create a repository for use with ra_dav or (non-tunneled)
> ra_svn, running the daemon as another user. I must create the
> repository as the user I'm going to run the daemon as, or chown it after
> I create it. Your patch would help eliminate the chown step, but it
> seems incongruous; other file creation commands, like mkdir and touch,
> do not have owner and group options to remove the need for a chown.
mkdir and touch are filesystem tools. 'svnadmin create' is a database
configuration tool (regardless that the DB itself is just a collection files).
I don't think you are comparing apples and oranges here. There is lot more
happening when you create a repository than just creating the files; and the
permissions have more to do with BDB itself than it does with Subversion itself.
>
> Use case: I create a repository for use with ra_local or tunneled ra_svn
> by multiple users. I must create the repository with a group which all
> the users are in, ensure that the repository is group-writable, ensure
> that the directory is mode g+s on certain systems, and ensure that all
> access uses a umask of 002 or 007. How will an option to svnadmin
> create help this use case?
It does create the repository with the correct group ownership, and if you tell
me how to determine where g+s is required, I can add that (I'm not up on where
the sticky bit is required). It doesn't help with the umask (which is also
documented elsewhere in Chapter 5).
The use case I am trying to solve is what I have experience with:
Mixed development: local users have access via ra_local (for performance) and
remote users either use tunneled ra_svn (if they have a local account) or ra_dav
via Apache. Apache runs as a non-priveledged user which is a member of a group
that all local users also belong to (svn). The database is owned by a local
user account. Once I have configured the user accounts (added them to the
correct group), I can create as many repositories as I want by merely running
'svnadmin create' without _any_ additional setup.
From what I have seen on the list, it would seem like this is the most common
case, but I might be wrong.
John
--
John Peacock
Director of Information Research and Technology
Rowman & Littlefield Publishing Group
4501 Forbes Boulevard
Suite H
Lanham, MD 20706
301-459-3366 x.5010
fax 301-429-5748
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Mon Nov 24 22:11:42 2003