How can I adjust subversion repository file permissions automatically for use w. Apache/DAV?

Question

I've set-up a subversion server accessible with Apache/DAV and after screwing up the repositories file permissions a couple of days ago I started wondering if there's a better way to do this than the way I'm doing it.

The repositories are owned by a dedicated user and group, and apache runs as the customary www:www user, hence it has no write permissions to the repositories. So far my solution has been to add the www user to the svn group and make sure that the files inside the repositories are group-writable... but six months from now I'll create a new repository, forget to fix file permissions and get some email as soon as someone tries to commit something.

Is there any other way to do that? Maybe force svnadmin to create repositories group-writable in the first place? (In case you're wondering the server is FreeBSD 6.2)

Solution 1

When you access the repository with Apache, the user Apache runs as must have write permission. So, the simplest solution is to give the repository to this user.

Here is how it looks on my Debian machine where Apache runs as www-data:

    % ls -ald /home/Subversion-Repository 
    drwxr-xr-x 7 www-data www-data 4096 Nov 14 10:02 /home/Subversion-Repository

This is only a problem if you want the same repository to be accessible via Apache/DAV and via another mean. But this practice is discouraged. I quote:

Fortunately, most repository administrators will never need to have such a complex configuration. Users who wish to access repositories that live on the same machine are not limited to using file:// access URLs—they can typically contact the Apache HTTP server or svnserve using localhost for the server name in their http:// or svn:// URL. And maintaining multiple server processes for your Subversion repositories is likely to be more of a headache than necessary. We recommend that you choose a single server that best meets your needs and stick with it!

Solution 2

The long term solution is to use ACLS to allow the www user write access to the directory tree and all future directories created in the tree.

Try this URL to get started.

http://www.onlamp.com/pub/a/bsd/2005/09/22/FreeBSD_Basics.html

-Brian

Comments

[ALex_hha]

You could grant access only to user under which apache is running (www-data/apache/etc...)