Re: CVSROOT write permission vulnerability

[Eric Siegerman]

On Mon, Jan 20, 2003 at 10:53:38AM -0500, Larry Jones wrote:
> > As CVSROOT requires write permission, it has 777 permission for
> > all.
> 
> Setting the sticky bit (chmod -t) on a directory prevents normal users
> from deleting or renaming files in that directory unless they own them.

Doing that in the repo would break CVS completely, wouldn't it?
For most users, a commit would fail at the point where it tried
to delete the old ,v file and rename the temporary copy (indeed,
the sticky bit would independently block both of those
operations).  So only the owner of a given ,v file, and the owner
of its parent directory, would be able to commit new revisions.

To the original poster:  Larry's main point still holds.  Use
client/server, not NFS.  That'll also help you with the
permissions problem, if you do it right.  Doing it "right" has
been discussed here many times; for details, try searching the
list archives.

--

|  | /\
|-_|/  >   Eric Siegerman, Toronto, Ont.        address@hidden
|  |  /
Just Say No to the "faceless cannonfodder" stereotype.
        - http://www.ainurin.net/ (an Orc site)