/contrib/cvs/contrib/cvs_acls.in
Autoconf | 963 lines | 609 code | 200 blank | 154 comment | 143 complexity | 0e4a373ebb40e8191f679394fb7c4d9c MD5 | raw file
1#! @PERL@ -T 2# -*-Perl-*- 3 4# Copyright (C) 1994-2005 The Free Software Foundation, Inc. 5 6# This program is free software; you can redistribute it and/or modify 7# it under the terms of the GNU General Public License as published by 8# the Free Software Foundation; either version 2, or (at your option) 9# any later version. 10# 11# This program is distributed in the hope that it will be useful, 12# but WITHOUT ANY WARRANTY; without even the implied warranty of 13# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14# GNU General Public License for more details. 15 16############################################################################### 17############################################################################### 18############################################################################### 19# 20# THIS SCRIPT IS PROBABLY BROKEN. REMOVING THE -T SWITCH ON THE #! LINE ABOVE 21# WOULD FIX IT, BUT THIS IS INSECURE. WE RECOMMEND FIXING THE ERRORS WHICH THE 22# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS 23# SERVER TRIGGER. PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND 24# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE 25# <@PACKAGE_BUGREPORT@> MAILING LIST. 26# 27# For more on general Perl security and taint-checking, please try running the 28# `perldoc perlsec' command. 29# 30############################################################################### 31############################################################################### 32############################################################################### 33 34=head1 Name 35 36cvs_acls - Access Control List for CVS 37 38=head1 Synopsis 39 40In 'commitinfo': 41 42 repository/path/to/restrict $CVSROOT/CVSROOT/cvs_acls [-d][-u $USER][-f <logfile>] 43 44where: 45 46 -d turns on debug information 47 -u passes the client-side userId to the cvs_acls script 48 -f specifies an alternate filename for the restrict_log file 49 50In 'cvsacl': 51 52 {allow.*,deny.*} [|user,user,... [|repos,repos,... [|branch,branch,...]]] 53 54where: 55 56 allow|deny - allow: commits are allowed; deny: prohibited 57 user - userId to be allowed or restricted 58 repos - file or directory to be allowed or restricted 59 branch - branch to be allowed or restricted 60 61See below for examples. 62 63=head1 Licensing 64 65cvs_acls - provides access control list functionality for CVS 66 67Copyright (c) 2004 by Peter Connolly <peter.connolly@cnet.com> 68All rights reserved. 69 70This program is free software; you can redistribute it and/or modify 71it under the terms of the GNU General Public License as published by 72the Free Software Foundation; either version 2 of the License, or 73(at your option) any later version. 74 75This program is distributed in the hope that it will be useful, 76but WITHOUT ANY WARRANTY; without even the implied warranty of 77MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 78GNU General Public License for more details. 79 80You should have received a copy of the GNU General Public License 81along with this program; if not, write to the Free Software 82Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 83 84=head1 Description 85 86This script--cvs_acls--is invoked once for each directory within a 87"cvs commit". The set of files being committed for that directory as 88well as the directory itself, are passed to this script. This script 89checks its 'cvsacl' file to see if any of the files being committed 90are on the 'cvsacl' file's restricted list. If any of the files are 91restricted, then the cvs_acls script passes back an exit code of 1 92which disallows the commits for that directory. 93 94Messages are returned to the committer indicating the file(s) that 95he/she are not allowed to committ. Additionally, a site-specific 96set of messages (e.g., contact information) can be included in these 97messages. 98 99When a commit is prohibited, log messages are written to a restrict_log 100file in $CVSROOT/CVSROOT. This default file can be redirected to 101another destination. 102 103The script is triggered from the 'commitinfo' file in $CVSROOT/CVSROOT/. 104 105=head1 Enhancements 106 107This section lists the bug fixes and enhancements added to cvs_acls 108that make up the current cvs_acls. 109 110=head2 Fixed Bugs 111 112This version attempts to get rid the following bugs from the 113original version of cvs_acls: 114 115=over 2 116 117=item * 118Multiple entries on an 'cvsacl' line will be matched individually, 119instead of requiring that all commit files *exactly* match all 120'cvsacl' entries. Commiting a file not in the 'cvsacl' list would 121allow *all* files (including a restricted file) to be committed. 122 123[IMO, this basically made the original script unuseable for our 124situation since any arbitrary combination of committed files could 125avoid matching the 'cvsacl's entries.] 126 127=item * 128Handle specific filename restrictions. cvs_acls didn't restrict 129individual files specified in 'cvsacl'. 130 131=item * 132Correctly handle multiple, specific filename restrictions 133 134=item * 135Prohibit mix of dirs and files on a single 'cvsacl' line 136[To simplify the logic and because this would be normal usage.] 137 138=item * 139Correctly handle a mixture of branch restrictions within one work 140directory 141 142=item * 143$CVSROOT existence is checked too late 144 145=item * 146Correctly handle the CVSROOT=:local:/... option (useful for 147interactive testing) 148 149=item * 150Replacing shoddy "$universal_off" logic 151(Thanks to Karl-Konig Konigsson for pointing this out.) 152 153=back 154 155=head2 Enhancements 156 157=over 2 158 159=item * 160Checks modules in the 'cvsacl' file for valid files and directories 161 162=item * 163Accurately report restricted entries and their matching patterns 164 165=item * 166Simplified and commented overly complex PERL REGEXPs for readability 167and maintainability 168 169=item * 170Skip the rest of processing if a mismatch on portion of the 'cvsacl' line 171 172=item * 173Get rid of opaque "karma" messages in favor of user-friendly messages 174that describe which user, file(s) and branch(es) were disallowed. 175 176=item * 177Add optional 'restrict_msg' file for additional, site-specific 178restriction messages. 179 180=item * 181Take a "-u" parameter for $USER from commit_prep so that the script 182can do restrictions based on the client-side userId rather than the 183server-side userId (usually 'cvs'). 184 185(See discussion below on "Admin Setup" for more on this point.) 186 187=item * 188Added a lot more debug trace 189 190=item * 191Tested these restrictions with concurrent use of pserver and SSH 192access to model our transition from pserver to ext access. 193 194=item * 195Added logging of restricted commit attempts. 196Restricted commits can be sent to a default file: 197$CVSROOT/CVSROOT/restrictlog or to one passed to the script 198via the -f command parameter. 199 200=back 201 202=head2 ToDoS 203 204=over 2 205 206=item * 207Need to deal with pserver/SSH transition with conflicting umasks? 208 209=item * 210Use a CPAN module to handle command parameters. 211 212=item * 213Use a CPAN module to clone data structures. 214 215=back 216 217=head1 Version Information 218 219This is not offered as a fix to the original 'cvs_acls' script since it 220differs substantially in goals and methods from the original and there 221are probably a significant number of people out there that still require 222the original version's functionality. 223 224The 'cvsacl' file flags of 'allow' and 'deny' were intentionally 225changed to 'allow' and 'deny' because there are enough differences 226between the original script's behavior and this one's that we wanted to 227make sure that users will rethink their 'cvsacl' file formats before 228plugging in this newer script. 229 230Please note that there has been very limited cross-platform testing of 231this script!!! (We did not have the time or resources to do exhaustive 232cross-platform testing.) 233 234It was developed and tested under Red Hat Linux 9.0 using PERL 5.8.0. 235Additionally, it was built and tested under Red Hat Linux 7.3 using 236PERL 5.6.1. 237 238$Id: cvs_acls.in,v 1.4.4.6 2005/09/01 13:44:49 dprice Exp $ 239 240This version is based on the 1.11.13 version of cvs_acls 241peter.connolly@cnet.com (Peter Connolly) 242 243 Access control lists for CVS. dgg@ksr.com (David G. Grubbs) 244 Branch specific controls added by voisine@bytemobile.com (Aaron Voisine) 245 246=head1 Installation 247 248To use this program, do the following four things: 249 2500. Install PERL, version 5.6.1 or 5.8.0. 251 2521. Admin Setup: 253 254 There are two choices here. 255 256 a) The first option is to use the $ENV{"USER"}, server-side userId 257 (from the third column of your pserver 'passwd' file) as the basis for 258 your restrictions. In this case, you will (at a minimum) want to set 259 up a new "cvsadmin" userId and group on the pserver machine. 260 CVS administrators will then set up their 'passwd' file entries to 261 run either as "cvs" (for regular users) or as "cvsadmin" (for power 262 users). Correspondingly, your 'cvsacl' file will only list 'cvs' 263 and 'cvsadmin' as the userIds in the second column. 264 265 Commentary: A potential weakness of this is that the xinetd 266 cvspserver process will need to run as 'root' in order to switch 267 between the 'cvs' and the 'cvsadmin' userIds. Some sysadmins don't 268 like situations like this and may want to chroot the process. 269 Talk to them about this point... 270 271 b) The second option is to use the client-side userId as the basis for 272 your restrictions. In this case, all the xinetd cvspserver processes 273 can run as userId 'cvs' and no 'root' userId is required. If you have 274 a 'passwd' file that lists 'cvs' as the effective run-time userId for 275 all your users, then no changes to this file are needed. Your 'cvsacl' 276 file will use the individual, client-side userIds in its 2nd column. 277 278 As long as the userIds in pserver's 'passwd' file match those userIds 279 that your Linux server know about, this approach is ideal if you are 280 planning to move from pserver to SSH access at some later point in time. 281 Just by switching the CVSROOT var from CVSROOT=:pserver:<userId>... to 282 CVSROOT=:ext:<userId>..., users can switch over to SSH access without 283 any other administrative changes. When all users have switched over to 284 SSH, the inherently insecure xinetd cvspserver process can be disabled. 285 [http://ximbiot.com/cvs/manual/cvs-1.11.17/cvs_2.html#SEC32] 286 287 :TODO: The only potential glitch with the SSH approach is the possibility 288 that each user can have differing umasks that might interfere with one 289 another, especially during a transition from pserver to SSH. As noted 290 in the ToDo section, this needs a good strategy and set of tests for that 291 yet... 292 2932. Put two lines, as the *only* non-comment lines, in your commitinfo file: 294 295 ALL $CVSROOT/CVSROOT/commit_prep 296 ALL $CVSROOT/CVSROOT/cvs_acls [-d][-u $USER ][-f <logfilename>] 297 298 where "-d" turns on debug trace 299 "-u $USER" passes the client-side userId to cvs_acls 300 "-f <logfilename"> overrides the default filename used to log 301 restricted commit attempts. 302 303 (These are handled in the processArgs() subroutine.) 304 305If you are using client-side userIds to restrict access to your 306repository, make sure that they are in this order since the commit_prep 307script is required in order to pass the $USER parameter. 308 309A final note about the repository matching pattern. The example above 310uses "ALL" but note that this means that the cvs_acls script will run 311for each and every commit in your repository. Obviously, in a large 312repository this adds up to a lot of overhead that may not be necesary. 313A better strategy is to use a repository pattern that is more specific 314to the areas that you wish to secure. 315 3163. Install this file as $CVSROOT/CVSROOT/cvs_acls and make it executable. 317 3184. Create a file named CVSROOT/cvsacl and optionally add it to 319 CVSROOT/checkoutlist and check it in. See the CVS manual's 320 administrative files section about checkoutlist. Typically: 321 322 $ cvs checkout CVSROOT 323 $ cd CVSROOT 324 [ create the cvsacl file, include 'commitinfo' line ] 325 [ add cvsacl to checkoutlist ] 326 $ cvs add cvsacl 327 $ cvs commit -m 'Added cvsacl for use with cvs_acls.' cvsacl checkoutlist 328 329Note: The format of the 'cvsacl' file is described in detail immediately 330below but here is an important set up point: 331 332 Make sure to include a line like the following: 333 334 deny||CVSROOT/commitinfo CVSROOT/cvsacl 335 allow|cvsadmin|CVSROOT/commitinfo CVSROOT/cvsacl 336 337 that restricts access to commitinfo and cvsacl since this would be one of 338 the easiest "end runs" around this ACL approach. ('commitinfo' has the 339 line that executes the cvs_acls script and, of course, all the 340 restrictions are in 'cvsacl'.) 341 3425. (Optional) Create a 'restrict_msg' file in the $CVSROOT/CVSROOT directory. 343 Whenever there is a restricted file or dir message, cvs_acls will look 344 for this file and, if it exists, print its contents as part of the 345 commit-denial message. This gives you a chance to print any site-specific 346 information (e.g., who to call, what procedures to look up,...) whenever 347 a commit is denied. 348 349=head1 Format of the cvsacl file 350 351The 'cvsacl' file determines whether you may commit files. It contains lines 352read from top to bottom, keeping track of whether a given user, repository 353and branch combination is "allowed" or "denied." The script will assume 354"allowed" on all repository paths until 'allow' and 'deny' rules change 355that default. 356 357The normal pattern is to specify an 'deny' rule to turn off 358access to ALL users, then follow it with a matching 'allow' rule that will 359turn on access for a select set of users. In the case of multiple rules for 360the same user, repository and branch, the last one takes precedence. 361 362Blank lines and lines with only comments are ignored. Any other lines not 363beginning with "allow" or "deny" are logged to the restrict_log file. 364 365Lines beginning with "allow" or "deny" are assumed to be '|'-separated 366triples: (All spaces and tabs are ignored in a line.) 367 368 {allow.*,deny.*} [|user,user,... [|repos,repos,... [|branch,branch,...]]] 369 370 1. String starting with "allow" or "deny". 371 2. Optional, comma-separated list of usernames. 372 3. Optional, comma-separated list of repository pathnames. 373 These are pathnames relative to $CVSROOT. They can be directories or 374 filenames. A directory name allows or restricts access to all files and 375 directories below it. One line can have either directories or filenames 376 but not both. 377 4. Optional, comma-separated list of branch tags. 378 If not specified, all branches are assumed. Use HEAD to reference the 379 main branch. 380 381Example: (Note: No in-line comments.) 382 383 # ----- Make whole repository unavailable. 384 deny 385 386 # ----- Except for user "dgg". 387 allow|dgg 388 389 # ----- Except when "fred" or "john" commit to the 390 # module whose repository is "bin/ls" 391 allow|fred, john|bin/ls 392 393 # ----- Except when "ed" commits to the "stable" 394 # branch of the "bin/ls" repository 395 allow|ed|/bin/ls|stable 396 397=head1 Program Logic 398 399CVS passes to @ARGV an absolute directory pathname (the repository 400appended to your $CVSROOT variable), followed by a list of filenames 401within that directory that are to be committed. 402 403The script walks through the 'cvsacl' file looking for matches on 404the username, repository and branch. 405 406A username match is simply the user's name appearing in the second 407column of the cvsacl line in a space-or-comma separate list. If 408blank, then any user will match. 409 410A repository match: 411 412=over 2 413 414=item * 415Each entry in the modules section of the current 'cvsacl' line is 416examined to see if it is a dir or a file. The line must have 417either files or dirs, but not both. (To simplify the logic.) 418 419=item * 420If neither, then assume the 'cvsacl' file was set up in error and 421skip that 'allow' line. 422 423=item * 424If a dir, then each dir pattern is matched separately against the 425beginning of each of the committed files in @ARGV. 426 427=item * 428If a file, then each file pattern is matched exactly against each 429of the files to be committed in @ARGV. 430 431=item * 432Repository and branch must BOTH match together. This is to cover 433the use case where a user has multiple branches checked out in 434a single work directory. Commit files can be from different 435branches. 436 437A branch match is either: 438 439=over 4 440 441=item * 442When no branches are listed in the fourth column. ("Match any.") 443 444=item * 445All elements from the fourth column are matched against each of 446the tag names for $ARGV[1..$#ARGV] found in the %branches file. 447 448=back 449 450=item * 451'allow' match remove that match from the tally map. 452 453=item * 454Restricted ('deny') matches are saved in the %repository_matches 455table. 456 457=item * 458If there is a match on user, repository and branch: 459 460 If repository, branch and user match 461 if 'deny' 462 add %repository_matches entries to %restricted_entries 463 else if 'allow' 464 remove %repository_matches entries from %restricted_entries 465 466=item * 467At the end of all the 'cvsacl' line checks, check to see if there 468are any entries in the %restricted_entries. If so, then deny the 469commit. 470 471=back 472 473=head2 Pseudocode 474 475 read CVS/Entries file and create branch{file}->{branch} hash table 476 + for each 'allow' and 'deny' line in the 'cvsacl' file: 477 | user match? 478 | - Yes: set $user_match = 1; 479 | repository and branch match? 480 | - Yes: add to %repository_matches; 481 | did user, repository match? 482 | - Yes: if 'deny' then 483 | add %repository_matches -> %restricted_entries 484 | if 'allow' then 485 | remove %repository_matches <- %restricted_entries 486 + end for loop 487 any saved restrictions? 488 no: exit, 489 set exit code allowing commits and exit 490 yes: report restrictions, 491 set exit code prohibiting commits and exit 492 493=head2 Sanity Check 494 495 1) file allow trumps a dir deny 496 deny||java/lib 497 allow||java/lib/README 498 2) dir allow can undo a file deny 499 deny||java/lib/README 500 allow||java/lib 501 3) file deny trumps a dir allow 502 allow||java/lib 503 deny||java/lib/README 504 4) dir deny trumps a file allow 505 allow||java/lib/README 506 deny||java/lib 507 ... so last match always takes precedence 508 509=cut 510 511$debug = 0; # Set to 1 for debug messages 512 513%repository_matches = (); # hash of match file and pattern from 'cvsacl' 514 # repository_matches --> [branch, matching-pattern] 515 # (Used during module/branch matching loop) 516 517%restricted_entries = (); # hash table of restricted commit files (from @ARGV) 518 # restricted_entries --> branch 519 # (If user/module/branch all match on an 'deny' 520 # line, then entries added to this map.) 521 522%branch; # hash table of key: commit file; value: branch 523 # Built from ".../CVS/Entries" file of directory 524 # currently being examined 525 526# ---------------------------------------------------------------- get CVSROOT 527$cvsroot = $ENV{'CVSROOT'}; 528die "Must set CVSROOT\n" if !$cvsroot; 529if ($cvsroot =~ /:([\/\w]*)$/) { # Filter ":pserver:", ":local:"-type prefixes 530 $cvsroot = $1; 531} 532 533# ------------------------------------------------------------- set file paths 534$entries = "CVS/Entries"; # client-side file??? 535$cvsaclfile = $cvsroot . "/CVSROOT/cvsacl"; 536$restrictfile = $cvsroot . "/CVSROOT/restrict_msg"; 537$restrictlog = $cvsroot . "/CVSROOT/restrict_log"; 538 539# --------------------------------------------------------------- process args 540$user_name = processArgs(\@ARGV); 541 542print("$$ \@ARGV after processArgs is: @ARGV.\n") if $debug; 543print("$$ ========== Begin $PROGRAM_NAME for \"$ARGV[0]\" repository. ========== \n") if $debug; 544 545# --------------------------------------------------------------- filter @ARGV 546eval "print STDERR \$die='Unknown parameter $1\n' if !defined \$$1; \$$1=\$';" 547 while ($ARGV[0] =~ /^(\w+)=/ && shift(@ARGV)); 548exit 255 if $die; # process any variable=value switches 549 550print("$$ \@ARGV after shift processing contains:",join("\, ",@ARGV),".\n") if $debug; 551 552# ---------------------------------------------------------------- get cvsroot 553($repository = shift) =~ s:^$cvsroot/::; 554grep($_ = $repository . '/' . $_, @ARGV); 555 556print("$$ \$cvsroot is: $cvsroot.\n") if $debug; 557print "$$ Repos: $repository\n","$$ ==== ",join("\n$$ ==== ",@ARGV),"\n" if $debug; 558 559$exit_val = 0; # presume good exit value for commit 560 561# ---------------------------------------------------------------------------- 562# ---------------------------------- create hash table $branch{file -> branch} 563# ---------------------------------------------------------------------------- 564 565# Here's a typical Entries file: 566# 567# /checkoutlist/1.4/Wed Feb 4 23:51:23 2004// 568# /cvsacl/1.3/Tue Feb 24 23:05:43 2004// 569# ... 570# /verifymsg/1.1/Fri Mar 16 19:56:24 2001// 571# D/backup//// 572# D/temp//// 573 574open(ENTRIES, $entries) || die("Cannot open $entries.\n"); 575print("$$ File / Branch\n") if $debug; 576my $i = 0; 577while(<ENTRIES>) { 578 chop; 579 next if /^\s*$/; # Skip blank lines 580 $i = $i + 1; 581 if (m| 582 / # 1st slash 583 ([\w.-]*) # file name -> $1 584 / # 2nd slash 585 .* # revision number 586 / # 3rd slash 587 .* # date and time 588 / # 4th slash 589 .* # keyword 590 / # 5th slash 591 T? # 'T' constant 592 (\w*) # branch -> #2 593 |x) { 594 $branch{$repository . '/' . $1} = ($2) ? $2 : "HEAD"; 595 print "$$ CVS Entry $i: $1/$2\n" if $debug; 596 } 597} 598close(ENTRIES); 599 600# ---------------------------------------------------------------------------- 601# ------------------------------------- evaluate each active line from 'cvsacl' 602# ---------------------------------------------------------------------------- 603open (CVSACL, $cvsaclfile) || exit(0); # It is ok for cvsacl file not to exist 604while (<CVSACL>) { 605 chop; 606 next if /^\s*\#/; # skip comments 607 next if /^\s*$/; # skip blank lines 608 # --------------------------------------------- parse current 'cvsacl' line 609 print("$$ ==========\n$$ Processing \'cvsacl\' line: $_.\n") if $debug; 610 ($cvsacl_flag, $cvsacl_userIds, $cvsacl_modules, $cvsacl_branches) = split(/[\s,]*\|[\s,]*/, $_); 611 612 # ------------------------------ Validate 'allow' or 'deny' line prefix 613 if ($cvsacl_flag !~ /^allow/ && $cvsacl_flag !~ /^deny/) { 614 print ("Bad cvsacl line: $_\n") if $debug; 615 $log_text = sprintf "Bad cvsacl line: %s", $_; 616 write_restrictlog_record($log_text); 617 next; 618 } 619 620 # -------------------------------------------------- init loop match flags 621 $user_match = 0; 622 %repository_matches = (); 623 624 # ------------------------------------------------------------------------ 625 # ---------------------------------------------------------- user matching 626 # ------------------------------------------------------------------------ 627 # $user_name considered "in user list" if actually in list or is NULL 628 $user_match = (!$cvsacl_userIds || grep ($_ eq $user_name, split(/[\s,]+/,$cvsacl_userIds))); 629 print "$$ \$user_name: $user_name \$user_match match flag is: $user_match.\n" if $debug; 630 if (!$user_match) { 631 next; # no match, skip to next 'cvsacl' line 632 } 633 634 # ------------------------------------------------------------------------ 635 # ---------------------------------------------------- repository matching 636 # ------------------------------------------------------------------------ 637 if (!$cvsacl_modules) { # blank module list = all modules 638 if (!$cvsacl_branches) { # blank branch list = all branches 639 print("$$ Adding all modules to \%repository_matches; null " . 640 "\$cvsacl_modules and \$cvsacl_branches.\n") if $debug; 641 for $commit_object (@ARGV) { 642 $repository_matches{$commit_object} = [$branch{$commit_object}, $cvsacl_modules]; 643 print("$$ \$repository_matches{$commit_object} = " . 644 "[$branch{$commit_object}, $cvsacl_modules].\n") if $debug; 645 } 646 } 647 else { # need to check for repository match 648 @branch_list = split (/[\s,]+/,$cvsacl_branches); 649 print("$$ Branches from \'cvsacl\' record: ", join(", ",@branch_list),".\n") if $debug; 650 for $commit_object (@ARGV) { 651 if (grep($branch{$commit_object}, @branch_list)) { 652 $repository_matches{$commit_object} = [$branch{$commit_object}, $cvsacl_modules]; 653 print("$$ \$repository_matches{$commit_object} = " . 654 "[$branch{$commit_object}, $cvsacl_modules].\n") if $debug; 655 } 656 } 657 } 658 } 659 else { 660 # ----------------------------------- check every argument combination 661 # parse 'cvsacl' modules to array 662 my @module_list = split(/[\s,]+/,$cvsacl_modules); 663 # ------------- Check all modules in list for either file or directory 664 my $fileType = ""; 665 if (($fileType = checkFileness(@module_list)) eq "") { 666 next; # skip bad file types 667 } 668 # ---------- Check each combination of 'cvsacl' modules vs. @ARGV files 669 print("$$ Checking matches for \@module_list: ", join("\, ",@module_list), ".\n") if $debug; 670 # loop thru all command-line commit objects 671 for $commit_object (@ARGV) { 672 # loop thru all modules on 'cvsacl' line 673 for $cvsacl_module (@module_list) { 674 print("$$ Is \'cvsacl\': $cvsacl_modules pattern in: \@ARGV " . 675 "\$commit_object: $commit_object?\n") if $debug; 676 # Do match of beginning of $commit_object 677 checkModuleMatch($fileType, $commit_object, $cvsacl_module); 678 } # end for commit objects 679 } # end for cvsacl modules 680 } # end if 681 682 print("$$ Matches for: \%repository_matches: ", join("\, ", (keys %repository_matches)), ".\n") if $debug; 683 684 # ------------------------------------------------------------------------ 685 # ----------------------------------------------------- setting exit value 686 # ------------------------------------------------------------------------ 687 if ($user_match && %repository_matches) { 688 print("$$ An \"$cvsacl_flag\" match on User(s): $cvsacl_userIds; Module(s):" . 689 " $cvsacl_modules; Branch(es): $cvsacl_branches.\n") if $debug; 690 if ($cvsacl_flag eq "deny") { 691 # Add all matches to the hash of restricted modules 692 foreach $commitFile (keys %repository_matches) { 693 print("$$ Adding \%repository_matches entry: $commitFile.\n") if $debug; 694 $restricted_entries{$commitFile} = $repository_matches{$commitFile}[0]; 695 } 696 } 697 else { 698 # Remove all matches from the restricted modules hash 699 foreach $commitFile (keys %repository_matches) { 700 print("$$ Removing \%repository_matches entry: $commitFile.\n") if $debug; 701 delete $restricted_entries{$commitFile}; 702 } 703 } 704 } 705 print "$$ ==== End of processing for \'cvsacl\' line: $_.\n" if $debug; 706} 707close(CVSACL); 708 709# ---------------------------------------------------------------------------- 710# --------------------------------------- determine final 'commit' disposition 711# ---------------------------------------------------------------------------- 712if (%restricted_entries) { # any restricted entries? 713 $exit_val = 1; # don't commit 714 print("**** Access denied: Insufficient authority for user: '$user_name\' " . 715 "to commit to \'$repository\'.\n**** Contact CVS Administrators if " . 716 "you require update access to these directories or files.\n"); 717 print("**** file(s)/dir(s) restricted were:\n\t", join("\n\t",keys %restricted_entries), "\n"); 718 printOptionalRestrictionMessage(); 719 write_restrictlog(); 720} 721elsif (!$exit_val && $debug) { 722 print "**** Access allowed: Sufficient authority for commit.\n"; 723} 724 725print "$$ ==== \$exit_val = $exit_val\n" if $debug; 726exit($exit_val); 727 728# ---------------------------------------------------------------------------- 729# -------------------------------------------------------------- end of "main" 730# ---------------------------------------------------------------------------- 731 732 733# ---------------------------------------------------------------------------- 734# -------------------------------------------------------- process script args 735# ---------------------------------------------------------------------------- 736sub processArgs { 737 738# This subroutine is passed a reference to @ARGV. 739 740# If @ARGV contains a "-u" entry, use that as the effective userId. In this 741# case, the userId is the client-side userId that has been passed to this 742# script by the commit_prep script. (This is why the commit_prep script must 743# be placed *before* the cvs_acls script in the commitinfo admin file.) 744 745# Otherwise, pull the userId from the server-side environment. 746 747 my $userId = ""; 748 my ($argv) = shift; # pick up ref to @ARGV 749 my @argvClone = (); # immutable copy for foreach loop 750 for ($i=0; $i<(scalar @{$argv}); $i++) { 751 $argvClone[$i]=$argv->[$i]; 752 } 753 754 print("$$ \@_ to processArgs is: @_.\n") if $debug; 755 756 # Parse command line arguments (file list is seen as one arg) 757 foreach $arg (@argvClone) { 758 print("$$ \$arg for processArgs loop is: $arg.\n") if $debug; 759 # Set $debug flag? 760 if ($arg eq '-d') { 761 shift @ARGV; 762 $debug = 1; 763 print("$$ \$debug flag set on.\n") if $debug; 764 print STDERR "Debug turned on...\n"; 765 } 766 # Passing in a client-side userId? 767 elsif ($arg eq '-u') { 768 shift @ARGV; 769 $userId = shift @ARGV; 770 print("$$ client-side \$userId set to: $userId.\n") if $debug; 771 } 772 # An override for the default restrictlog file? 773 elsif ($arg eq '-f') { 774 shift @ARGV; 775 $restrictlog = shift @ARGV; 776 } 777 else { 778 next; 779 } 780 } 781 782 # No client-side userId passed? then get from server env 783 if (!$userId) { 784 $userId = $ENV{"USER"} if !($userId = $ENV{"LOGNAME"}); 785 print("$$ server-side \$userId set to: $userId.\n") if $debug; 786 } 787 788 print("$$ processArgs returning \$userId: $userId.\n") if $debug; 789 return $userId; 790 791} 792 793 794# ---------------------------------------------------------------------------- 795# --------------------- Check all modules in list for either file or directory 796# ---------------------------------------------------------------------------- 797sub checkFileness { 798 799# Module patterns on the 'cvsacl' record can be files or directories. 800# If it's a directory, we pattern-match the directory name from 'cvsacl' 801# against the left side of the committed filename to see if the file is in 802# that hierarchy. By contrast, files use an explicit match. If the entries 803# are neither files nor directories, then the cvsacl file has been set up 804# incorrectly; we return a "" and the caller skips that line as invalid. 805# 806# This function determines whether the entries on the 'cvsacl' record are all 807# directories or all files; it cannot be a mixture. This restriction put in 808# to simplify the logic (without taking away much functionality). 809 810 my @module_list = @_; 811 print("$$ Checking \"fileness\" or \"dir-ness\" for \@module_list entries.\n") if $debug; 812 print("$$ Entries are: ", join("\, ",@module_list), ".\n") if $debug; 813 my $filetype = ""; 814 for $cvsacl_module (@module_list) { 815 my $reposDirName = $cvsroot . '/' . $cvsacl_module; 816 my $reposFileName = $reposDirName . "\,v"; 817 print("$$ In checkFileness: \$reposDirName: $reposDirName; \$reposFileName: $reposFileName.\n") if $debug; 818 if (((-d $reposDirName) && ($filetype eq "file")) || ((-f $reposFileName) && ($filetype eq "dir"))) { 819 print("Can\'t mix files and directories on single \'cvsacl\' file record; skipping entry.\n"); 820 print(" Please contact a CVS administrator.\n"); 821 $filetype = ""; 822 last; 823 } 824 elsif (-d $reposDirName) { 825 $filetype = "dir"; 826 print("$$ $reposDirName is a directory.\n") if $debug; 827 } 828 elsif (-f $reposFileName) { 829 $filetype = "file"; 830 print("$$ $reposFileName is a regular file.\n") if $debug; 831 } 832 else { 833 print("***** Item to commit was neither a regular file nor a directory.\n"); 834 print("***** Current \'cvsacl\' line ignored.\n"); 835 print("***** Possible problem with \'cvsacl\' admin file. Please contact a CVS administrator.\n"); 836 $filetype = ""; 837 $text = sprintf("Module entry on cvsacl line: %s is not a valid file or directory.\n", $cvsacl_module); 838 write_restrictlog_record($text); 839 last; 840 } # end if 841 } # end for 842 843 print("$$ checkFileness will return \$filetype: $filetype.\n") if $debug; 844 return $filetype; 845} 846 847 848# ---------------------------------------------------------------------------- 849# ----------------------------------------------------- check for module match 850# ---------------------------------------------------------------------------- 851sub checkModuleMatch { 852 853# This subroutine checks for a match between the directory or file pattern 854# specified in the 'cvsacl' file (i.e., $cvsacl_modules) versus the commit file 855# objects passed into the script via @ARGV (i.e., $commit_object). 856 857# The directory pattern only has to match the beginning portion of the commit 858# file's name for a match since all files under that directory are considered 859# a match. File patterns must exactly match. 860 861# Since (theoretically, if not normally in practice) a working directory can 862# contain a mixture of files from different branches, this routine checks to 863# see if there is also a match on branch before considering the file 864# comparison a match. 865 866 my $match_flag = ""; 867 868 print("$$ \@_ in checkModuleMatch is: @_.\n") if $debug; 869 my ($type,$commit_object,$cvsacl_module) = @_; 870 871 if ($type eq "file") { # Do exact file match of $commit_object 872 if ($commit_object eq $cvsacl_module) { 873 $match_flag = "file"; 874 } # Do dir match at beginning of $commit_object 875 } 876 elsif ($commit_object =~ /^$cvsacl_module\//) { 877 $match_flag = "dir"; 878 } 879 880 if ($match_flag) { 881 print("$$ \$repository: $repository matches \$commit_object: $commit_object.\n") if $debug; 882 if (!$cvsacl_branches) { # empty branch pattern matches all 883 print("$$ blank \'cvsacl\' branch matches all commit files.\n") if $debug; 884 $repository_matches{$commit_object} = [$branch{$commit_object}, $cvsacl_module]; 885 print("$$ \$repository_matches{$commit_object} = [$branch{$commit_object}, $cvsacl_module].\n") if $debug; 886 } 887 else { # otherwise check branch hash table 888 @branch_list = split (/[\s,]+/,$cvsacl_branches); 889 print("$$ Branches from \'cvsacl\' record: ", join(", ",@branch_list),".\n") if $debug; 890 if (grep(/$branch{$commit_object}/, @branch_list)) { 891 $repository_matches{$commit_object} = [$branch{$commit_object}, $cvsacl_module]; 892 print("$$ \$repository_matches{$commit_object} = [$branch{$commit_object}, " . 893 "$cvsacl_module].\n") if $debug; 894 } 895 } 896 } 897 898} 899 900# ---------------------------------------------------------------------------- 901# ------------------------------------------------------- check for file match 902# ---------------------------------------------------------------------------- 903sub printOptionalRestrictionMessage { 904 905# This subroutine optionally prints site-specific file restriction information 906# whenever a restriction condition is met. If the file 'restrict_msg' does 907# not exist, the routine immediately exits. If there is a 'restrict_msg' file 908# then all the contents are printed at the end of the standard restriction 909# message. 910 911# As seen from examining the definition of $restrictfile, the default filename 912# is: $CVSROOT/CVSROOT/restrict_msg. 913 914 open (RESTRICT, $restrictfile) || return; # It is ok for cvsacl file not to exist 915 while (<RESTRICT>) { 916 chop; 917 # print out each line 918 print("**** $_\n"); 919 } 920 921} 922 923# ---------------------------------------------------------------------------- 924# ---------------------------------------------------------- write log message 925# ---------------------------------------------------------------------------- 926sub write_restrictlog { 927 928# This subroutine iterates through the list of restricted entries and logs 929# each one to the error logfile. 930 931 # write each line in @text out separately 932 foreach $commitfile (keys %restricted_entries) { 933 $log_text = sprintf "Commit attempt by: %s for: %s on branch: %s", 934 $user_name, $commitfile, $branch{$commitfile}; 935 write_restrictlog_record($log_text); 936 } 937 938} 939 940# ---------------------------------------------------------------------------- 941# ---------------------------------------------------------- write log message 942# ---------------------------------------------------------------------------- 943sub write_restrictlog_record { 944 945# This subroutine receives a scalar string and writes it out to the 946# $restrictlog file as a separate line. Each line is prepended with the date 947# and time in the format: "2004/01/30 12:00:00 ". 948 949 $text = shift; 950 951 # return quietly if there is a problem opening the log file. 952 open(FILE, ">>$restrictlog") || return; 953 954 (@time) = localtime(); 955 956 # write each line in @text out separately 957 $log_record = sprintf "%04d/%02d/%02d %02d:%02d:%02d %s.\n", 958 $time[5]+1900, $time[4]+1, $time[3], $time[2], $time[1], $time[0], $text; 959 print FILE $log_record; 960 print("$$ restrict_log record being written: $log_record to $restrictlog.\n") if $debug; 961 962 close(FILE); 963}