Re: Can I prevent a file from being modified?

On Thu, Jul 21, 2011 at 12:47 PM, Andreas Krey <a.krey_at_gmx.de> wrote:
> On Thu, 21 Jul 2011 11:06:00 +0000, David Weintraub wrote:
>> I have a pre-commit hook that allows you to set a directory as
>> "add-only". This was mainly for the tags directory. You can create a
>> tag, but once created, it can't be modified.
>
> The devil's advocate wants to know it this script accidentally also
> allows adding new files/directories *within* a tag; thus getting
> interesting results when accidentally executing
>
>   svn cp $base/trunk $base/tags/blub -m "$message"

It all depends how you configure the control file. If you simply did
something like this:

file = /tags/**
user = @ALL
access = add-only

Then, it would be possible for someone to add a directory inside
another directory under the tags directory.

I haven't worried about this. My main concern isn't someone doing
something malicious, but doing something more human. For example, a
developer did a "svn switch" to a tag to see the files on a particular
revision, then promptly forgot they did the switch and edit that
working directory. No clue would be given that they were not on trunk
or a branch while doing their work, and they may simply not realize it
even after a commit.

However, if you want to prevent maliciousness, you first lock down the
directories under tags:

[FILE No modifying anything under /tags]
file = /tags/**
user = @ALL
access = read-only

This prevents any changes at all under the /tags directory.

Now, you add in the following:

[FILE Allow users to add new tags, but that's all]
file = /tags/*
user = @ALL
access = add-only

This allows you to add in directories directly under the "tags"
directory via an "svn cp", but you can't add anything under those
directories.

I don't make a distinction between files, and directories. It is
possible to use "svn add" to add in empty directories and files
directly under the /tags directory, so it's not entirely secure from
maliciousness. However, it really wouldn't do anything more than be
annoying and since this is version control, the culprit could easily
be caught.

-- 
David Weintraub
qazwart_at_gmail.com