From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue, 23 Jan 2007 16:18:28 GMT
Subject: Re: Repository Security
Message-ID: <Pine.LNX.4.64.0701230817010.32200@woody.linux-foundation.org>
In-Reply-To: <ep4q5e$ioc$1@sea.gmane.org>



On Tue, 23 Jan 2007, Jakub Narebski wrote:
> 
> I wonder if it would be enought for SSH (and perhaps HTTP/WebDAV access)
> just to rely on filesystem write access to refs/heads files (different
> files having different access rights), and filesystem ACLs.

I think the solution is simple: mark the refs/ directory as being sticky.

This is really no different from the /var/spool/mail/ situation: people 
want to change their own files (and create new files), but you can't allow 
people to overwrite other peoples files and filenames.

		Linus