The following example a basic test to ensure the
pre-commit
hook is properly installed and the SVNGroup server is enforcing
access control lists.
In this example a repository has been created with
svnadmin
in
/var/svn/repositories:
hardcore:/var/svn/repositories$ svnadmin create test
Since this is a new repository the
pre-commit script will have
to be created from the
pre-commit.tmpl template file.
hardcore:/var/svn/repositories/test/hooks$ cp pre-commit.tmpl pre-commit
hardcore:/var/svn/repositories/test/hooks$ chmod +x pre-commit
Now, edit the
pre-commit script and comment out the default
commit-access-control.pl script from executing and add the
SVNGroup
pre-commit snippet.
Now, let's import an initial project shell into the repository.
This can be done easily by creating a directory called
shell
and inside this directory issuing:
mkdir branches tags trunk
and then while still in the
shell directory type:
hardcore:/tmp/shell$ svn import . file://localhost/var/svn/repositories/test/calc -m"Initial import"
Adding trunk
Adding branches
Adding tags
If you look at the
sgserver logs you will see an XML message similar to:
<svngroup majorVersion="0" minorVersion="9" patchVersion="5">
<user password="" username="" />
<svninfo branch="" reporoot="file://localhost/var/svn/repositories/test"
repourl="file://localhost/var/svn/repositories/test"
repouuid="8798d2f7-d30b-4b4c-9296-2c0d9984fb7c" />
<command name="validatepaths">
<username>root</username>
<path name="calc/" type="path" />
<path name="calc/branches/" type="path" />
<path name="calc/tags/" type="path" />
<path name="calc/trunk/" type="path" />
</command>
</svngroup>
Every path that is being committed to the repository now goes through
the SVNGroup process. If you look at the continuation of the logs you
will see the logic that SVNGroup goes through to determine whether or
not the commit will be authorized:
For each path in the submission:
Is the path owned by a group?
If no, then this particular path is authorized
If yes, then
Is the given user a owner of the group to which the path belongs or do
they have a grant for the group?
If no, then this particular path is not authorized
If yes, then this particular path is authorized
Were all the paths examined authorized?
If yes, then the submission is authorized and can proceed.
If no, then the submission is not authorized, and rejected.
In this case the paths were new and groups have been created. Let's add
a group and place the calc/trunk directory under access control.
Most of the
svngroup commands work best when issued in a Subversion
working copy. Many can have the repository information supplied to them
with
--repository, but it's far easier to be in a working copy.
In
/tmp we'll check out the
calc/trunk branch.
hardcore:/tmp$ svn co file://localhost/var/svn/repositories/test/calc/trunk calc
Checked out revision 1.
Now, as the
admin user let's create a group, issuing this command in
the working copy
at the top-level of
calc/trunk. This is
important because
svngroup will detect what branch to create the
group for.
hardcore:/tmp/calc$ svngroup addgroup calc_root
Group calc_root created for URL file://localhost/var/svn/repositories/test/calc/trunk
(repository identified by 8798d2f7-d30b-4b4c-9296-2c0d9984fb7c) on branch calc/trunk
Note that because we issued the command in the top of the working copy
svngroup was able to accurately detect what branch we intend this group to
belong to.
We can now look at the details of the group:
hardcore:/tmp/calc$ svngroup list calc_root
Group: calc_root
Repository: 8798d2f7-d30b-4b4c-9296-2c0d9984fb7c
Base URL: file://localhost/var/svn/repositories/test/calc/trunk
Branch: calc/trunk
Owners:
Paths:
There are no paths and no owners in the group. Let's add a path, the
"dot" path, meaning, the calc/trunk directory itself. Without the dot-path
the group would not control submissions in the calc/trunk directory.
Before adding this path we need to let
admin own the group (at
least temporarily). This is a known annoyance. Future versions will allow
the administrator to add paths to any group regardless of whether the
administrator is an owner.
hardcore:/tmp/calc$ svngroup addowner calc_root admin
User 'admin' added as an owner to group 'calc_root'
hardcore:/tmp/calc$ svngroup addpath calc_root .
Path '.' has been added to group 'calc_root'
Now, let's say I'm ready to add and check something in to the calc/trunk
directory.
hardcore:/tmp/calc$ svn add README
A README
hardcore:/tmp/calc$ svn commit README
Adding README
The user trying to make the submission (root) is not authorized! SVNGroup
reports back:
svn: 'pre-commit' hook failed with error output:
SVNGroup commit failure:
NOAUTH:Path calc/trunk/README is not a member of any authorized group (belongs to group calc_root for branch calc/trunk)
svn: Your commit message was left in a temporary file:
svn: '/tmp/calc/svn-commit.tmp'
To remedy the situation we need to do two things: add a userid for root to
SVNGroup, and second, allow root to submit to the calc_root group by giving
him or her a
grant.
Again, as the
admin user (the ROOT in all caps is root's initial
svngroup password):
hardcore:/tmp/calc$ svngroup adduser root ROOT
User 'root' created as normal user
Now, a grant. We want root to able to submit their changes, but they've
indicated that there is only one change and they are going to do it within
the hour. So we create a grant that expires an hour from now (at the time
of this writing, approximately 3:22AM):
hardcore:/tmp/calc$ svngroup addgrant --expires 2008-06-08T03:22 calc_root root
User root granted submission permissions on group calc_root until 2008-06-08 03:22:00
The format for the grant expiration is in ISO8601 format minus the seconds
field.
We can see root can now submit to the calc_root group:
hardcore:/tmp/calc$ svngroup listgrants --user root
Grants for root:
Group Branch Expires On
------------------------ -------------------------------- -------------------
calc_root calc/trunk 2008-06-08 03:22:00
root tries the commit again:
hardcore:/tmp/calc$ sudo svn commit README
Adding README
Transmitting file data .
Committed revision 2.
Looking at the svngroup logs reveals:
2008-06-08 02:26:16,814 sgserver 181 INFO Processing validatepaths
2008-06-08 02:26:16,817 sgservercommands 971 INFO User root is authorized for group calc_root on branch calc/trunk
2008-06-08 02:26:16,820 sgservercommands 1013 INFO Built all possible paths user root is authorized for
2008-06-08 02:26:16,820 sgservercommands 1014 DEBUG ['calc/trunk']
2008-06-08 02:26:16,821 sgservercommands 1033 DEBUG calc/trunk/README normalized to calc/trunk/README
2008-06-08 02:26:16,821 sgservercommands 1057 DEBUG Path calc/trunk/README is authorized
2008-06-08 02:26:16,822 sgserver 202 DEBUG Server response: OK: All given paths are valid
SVNGroup determined that the root user could indeed submit to calc/trunk and
allowed the submission of the README file. The grant does not expire after
the submission however, but it will at the stated expiration.