Dear Subversion Development and Documentation Team:
First, I want to thank you for the Subversion software. We got it up
and running fairly quickly, and are quite satisfied with the support it
provides our geographically dispersed software development team.
I have an alternative solution to the permission bit problems often
encountered when accessing the repository and the repository resides on
a Linux or Unix system.
We wanted to have the entire set of repository files owned by a distinct
user, svn, and have write permission in the repository only by that user
in order to raise the bar against unintended modifications and
opportunities of recovery from backup. This is in preference to the
documented recommendation of collecting all authors into a group that
has write permission to the repository, as all writes should be made
only through the Subversion code, and not manually should some author
decide it a wise thing to do "a minor change just this one time".
We have the svnserve process run under user svn, which works fine when
accessing the repository via the svn method, but which is insufficient
when accessing it using the svn+ssh method, as the private svnserve
process spawned as a result runs as the originating user.
After a bit of head scratching, I hit upon the now-obvious idea of
having svnserve run as set-uid-to-svn. This of course required a manual
chown and chmod by root to the executable, and a similar change will
need to be made as we upgrade to new versions, but it allows us to have
the desirable property that the repository is resistant to change by
means outside the control of the Subversion software.
Feel free to use this suggestion as you see fit, including documenting
it as an alternative to enabling writes to the repository by a group of
authors.
Sincerely,
Ken Imboden
Nusym Technology, Inc.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Sat Nov 20 08:30:24 2004