Access to CVSROOT
We do not provide write access to CVSROOT in the CVS repositories because:
CVSROOT permits server-side hooks, which means essentially giving shell access. We do not want to provide shell access at Savannah
- so that nasty people cannot run arbitrary commands (DoS, exploits...)
- so that the CVS repository cannot be damaged, either
intentionally or by mistake (the repository can only be modified
through
cvs server)
You can trick CVS pserver into becoming any user you want, using CVSROOT/config and CVSROOT/passwd. This is a security issue that we want to avoid.
Question: SF provides write access to CVSROOT, how comes you don't?
A: Note that you still do not have direct shell access
at SF. You can bypass this restriction through CVSROOT hooks but
that's still a risk for your repository integrity (a bug in a script of
yours could corrupt your CVS history). We don't know how/if they protect
against miusing config and password though - technically you could
commit as another system user that way. We would be interested in more
information on that point.
Question: Can I read (not write) the CVSROOT/?
I tried to get it via CVS:
cvs -d :ext:me@cvs.savannah.nongnu.org:/cvsroot/my_group co CVSROOT
and I get an empty CVSROOT dir, this must be a new security feature?
A: Rather a simplification: there's no need for Savannah to use rcs to edit CVSROOT/ that way. (Also, indeed, you can't ask CVS to commit to CVSROOT even if its permissions were lax).
However you still can read it using:
rsync -av cvs.sv.nongnu.org::sources/my_group/CVSROOT .