svn: show how to enable path based permissions.

docs/admin/svn-path-permissions.rst

@@ -0,0 +1,80 b''
+.. _svn-path-permissions:
+
+|svn| Enabling Path Permissions
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Because |RCEE| uses standard svn apache mod_svn we can take advantage of the
+authz configuration to protect paths and branches.
+
+
+Configuring RhodeCode
+=====================
+
+
+1. To configure path based permissions first we need to use a customized
+   mod_dav_svn.conf.
+
+   Open :file:`home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+   And find `svn.proxy.config_template` setting. Now set a new path to read
+   the template from. For example:
+
+    .. code-block:: ini
+
+        svn.proxy.config_template = /home/ubuntu/rhodecode/custom_mod_dav_svn.conf.mako
+
+
+2. Create the file as in example: `/home/ubuntu/rhodecode/custom_mod_dav_svn.conf.mako`
+   You can download one from:
+
+    `<https://code.rhodecode.com/rhodecode-enterprise-ce/files/default/rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako/>`_
+
+3. Add (if not yet exists) a section `AuthzSVNReposRelativeAccessFile`  in order
+   to read the path auth file.
+
+   Example modified config section enabling reading the authz file relative
+   to repository path. Means located in `/storage_dir/repo_name/conf/authz`
+
+    .. code-block:: text
+
+
+        # snip ...
+
+        # use specific SVN conf/authz file for each repository
+        AuthzSVNReposRelativeAccessFile authz
+
+        Allow from all
+        # snip ...
+
+    .. note::
+
+       The `AuthzSVNReposRelativeAccessFile` should go above the `Allow from all`
+       directive.
+
+
+4. Restart RhodeCode, Go to
+   the :menuselection:`Admin --> Settings --> VCS` page, and
+   click :guilabel:`Generate Apache Config`.
+   This will now generate a new configuration with enabled changes to read
+   the authz file. You can verify if changes were made by checking the generated
+   mod_dav_svn.conf file which is included in your apache configuration.
+
+5. Specify new rules in the repository authz configuration.
+   edit a file in :file:`repo_name/conf/authz`. For example, we specify that
+   only admin is allowed to push to develop branch
+
+    .. code-block:: ini
+
+        [/branches/develop]
+        * = r
+        admin = rw
+
+
+   For more example see:
+   `<https://svn.apache.org/repos/asf/subversion/trunk/subversion/mod_authz_svn/INSTALL/>`_
+
+  Those rules also work for paths, so not only branches but all different
+  paths inside the repository can be specified.
+
+6. Reload Apache. If all is configured correctly it should not be allowed to
+   commit according to specified rules.
+

docs/admin/system-admin.rst

@@ -1,31 +1,32 b''
 .. _rhodecode-admin-ref:
 
 System Administration
 =====================
 
 The following are the most common system administration tasks.
 
 .. only:: latex
 
     * :ref:`vcs-server`
     * :ref:`apache-ws-ref`
     * :ref:`nginx-ws-ref`
     * :ref:`rhodecode-tuning-ref`
     * :ref:`indexing-ref`
     * :ref:`rhodecode-reset-ref`
 
 .. toctree::
 
     config-files-overview
     vcs-server
     svn-http
+    svn-path-permissions
     gunicorn-ssl-support
     apache-config
     nginx-config
     backup-restore
     tuning-rhodecode
     indexing
     reset-information
     enable-debug
     admin-tricks
     cleanup-cmds

rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako

@@ -1,88 +1,94 b''
 # Auto generated configuration for use with the Apache mod_dav_svn module.
 #
 # WARNING: Make sure your Apache instance which runs the mod_dav_svn module is
 #          only accessible by RhodeCode. Otherwise everyone is able to browse
 #          the repositories or run subversion operations (checkout/commit/etc.).
 #
 # The mod_dav_svn module does not support subversion repositories which are
 # organized in subfolders. To support the repository groups of RhodeCode it is
 # required to provide a <Location> block for each group pointing to the
 # repository group sub folder. To ease the configuration RhodeCode auto
 # generates this file whenever a repository group is created/changed/deleted.
 # Auto generation can be configured in the ini file. Settings are prefixed with
 # ``svn.proxy``.
 #
 # To include this configuration into your apache config you can use the
 # `Include` directive. See the following example snippet of a virtual host how
 # to include this configuration file.
 #
 #     <VirtualHost *:8090>
 #         ServerAdmin webmaster@localhost
 #         DocumentRoot /var/www/html
 #         ErrorLog ${'${APACHE_LOG_DIR}'}/error.log
 #         CustomLog ${'${APACHE_LOG_DIR}'}/access.log combined
 #         LogLevel info
 #         # allows custom host names, prevents 400 errors on checkout
 #         HttpProtocolOptions Unsafe
 #         Include /path/to/generated/mod_dav_svn.conf
 #     </VirtualHost>
 #
 # Depending on the apache configuration you may encounter the following error if
 # you are using special characters in your repository or repository group
 # names.
 #
 #    ``Error converting entry in directory '/path/to/repo' to UTF-8``
 #
 # In this case you have to change the LANG environment variable in the apache
 # configuration. This setting is typically located at ``/etc/apache2/envvars``.
 # You have to change it to an UTF-8 value like ``export LANG="en_US.UTF-8"``.
 # After changing this a stop and start of Apache is required (using restart
 # doesn't work).
 
 # fix https -> http downgrade with DAV. It requires an header downgrade for
 # https -> http reverse proxy to work properly
 % if use_https:
 RequestHeader edit Destination ^https: http: early
 % else:
 #RequestHeader edit Destination ^https: http: early
 % endif
 
 <Location "${location_root|n}">
     # The mod_dav_svn module takes the username from the apache request object.
     # Without authorization this will be empty and no username is logged for the
     # transactions. This will result in "(no author)" for each revision. The
     # following directives implement a fake authentication that allows every
     # username/password combination.
     AuthType Basic
     AuthName "${rhodecode_realm|n}"
     AuthBasicProvider anon
     Anonymous *
     Anonymous_LogEmail off
     Require valid-user
 
     DAV svn
     SVNParentPath "${parent_path_root|n}"
     SVNListParentPath ${"On" if svn_list_parent_path else "Off"|n}
 
+    # use specific SVN conf/authz file for each repository
+    #AuthzSVNReposRelativeAccessFile authz
+
     Allow from all
     Order allow,deny
 </Location>
 
 % for location, parent_path in repo_group_paths:
 
 <Location "${location|n}">
     AuthType Basic
     AuthName "${rhodecode_realm|n}"
     AuthBasicProvider anon
     Anonymous *
     Anonymous_LogEmail off
     Require valid-user
 
     DAV svn
     SVNParentPath "${parent_path|n}"
     SVNListParentPath ${"On" if svn_list_parent_path else "Off"|n}
 
+    # use specific SVN conf/authz file for each repository
+    #AuthzSVNReposRelativeAccessFile authz
+
     Allow from all
     Order allow,deny
 </Location>
 % endfor