Access to CVSROOT

We do not provide write access to CVSROOT in the CVS repositories because:

• CVSROOT permits server-side hooks, which means essentially giving shell access. We do not want to provide shell access at Savannah

  • so that nasty people cannot run arbitrary commands (DoS, exploits...)
  • so that the CVS repository cannot be damaged, either intentionally or by mistake (the repository can only be modified through cvs server)

• You can trick CVS pserver into becoming any user you want, using CVSROOT/config and CVSROOT/passwd. This is a security issue that we want to avoid.

Question: SF provides write access to CVSROOT, how comes you don't?

A: Note that you still do not have direct shell access at SF. You can bypass this restriction through CVSROOT hooks but that's still a risk for your repository integrity (a bug in a script of yours could corrupt your CVS history). We don't know how/if they protect against miusing config and password though - technically you could commit as another system user that way. We would be interested in more information on that point.

Question: Can I read (not write) the CVSROOT/?

I tried to get it via CVS:

   cvs -d :ext:me@cvs.savannah.nongnu.org:/cvsroot/my_group co CVSROOT

and I get an empty CVSROOT dir, this must be a new security feature?

A: Rather a simplification: there's no need for Savannah to use rcs to edit CVSROOT/ that way. (Also, indeed, you can't ask CVS to commit to CVSROOT even if its permissions were lax).

However you still can read it using:

   rsync -av cvs.sv.nongnu.org::sources/my_group/CVSROOT .